Data recovery and disk repair questions and discussions related to old-fashioned SATA, SAS, SCSI, IDE, MFM hard drives - any type of storage device that has moving parts
August 10th, 2022, 13:13
I have an old drive which is encrypted using Macfee Endpoint Encryption for Removable Media, password is known. The date modified suggests it was setup in 2015. The drive is ok, the partition mounts and MfeEERM.exe is visible, but it won't run. Double clicking or running as administrator does absolutely nothing. I've searched the net but I can't find anywhere to download a replacement executable for this program. Trying to get Macfee Support to help is as difficult as you'd expect.
Has anyone come across an issue like this?
August 10th, 2022, 15:32
What do you see when you launch the file from a CMD window?
August 11th, 2022, 0:11
It does nothing at all
C:\WINDOWS\system32>d:
D:\>MfeEERM.exe
D:\>
August 11th, 2022, 16:28
I ran the EXE file in the absence of a USB flash drive. As in your case, the program produced no output and dropped back to the CMD prompt. This suggests to me that this is the expected behaviour when it is unable to find a hidden McAfee Endpoint partition.
August 12th, 2022, 0:51
Thanks for those links, I'll have a look.
When I examine the structure of the drive, there is just one single partition the full size of the 2tb capacity. It starts at lba 2048 as you'd expect and goes to the end. The encrypted files are under a folder on the top level of the partition (same as MfeEERM.exe) callled "McAfee EERM" that can be seen when the partition is examined with data recovery software. There doesn't seem to be any hidden partitions, and there's one file that can be seen when Show Hidden Files is selected in Explorer called mfecc32.dll. Perhaps its expecting some other missing files on that top level?
August 22nd, 2022, 10:53
If I replace MfeEERM.exe on the drive with the .exe from those links, the console will open and prompt for a password. It seems to accept the password as it will say Please enter a correct password for any password input other than the known password. For the known password the password prompt goes away and opens the console, but no files will appear in it, it just has "Desktop" in the left panel. Clicking on it does nothing, and I can't drag and drop the location of the encrypted files, I can't get any further from that point. The MfeEERM.exe from those links is version 5.2.0.151, and the original is 4.2.0.178, so perhaps it won't work properly unless its the correct version.
I did have to adjust the permissions on the drive to allow me to make changes and replace MfeEERM.exe, so there is a chance it could be related to the altered permissions.
August 24th, 2022, 8:40
Just a crazy thought.........as it is removable media encryption are you connecting the drive via a usb port as it might be the app will only detect external devices?
PSD is portable storage device.
https://docplayer.net/9860630-A-usb-por ... edure.html
August 26th, 2022, 2:29
That was a good idea, I had been connecting the cloned drive by SATA. But still no luck connecting by USB.
August 26th, 2022, 3:01
Actually I finally cracked it. I copied all the individual files and some of the encrytped files and the same folder structure onto another empty external drive, but then replaced MfeEERM.exe with the one provided in the link by fzabkar, which was a later version than the original. That MfeEERM.exe wouldn't open normally just like the original, but when placed on an external drive probably with some of the hidden folder structure it was looking for, it would open the console. Entering the password it then must have scanned all connected external drives and found the clone of the original containing all the encrypted data, and then opened it. Thanks everyone for your help.
August 26th, 2022, 11:32
Thank you for taking the time to update, good job.
Powered by phpBB © phpBB Group.