Anything related to computer forensics (new section!)
Post a reply

Symantec Endpoint Decryption

April 25th, 2026, 13:10

I have an SSD from a laptop, it was getting Windows error and won't boot, and it has encryption by Symantec Endpoint Encryption 12.4 HF1
After removing the SSD, I was able to make a full image, regardless of a few sectors in the middle of the SSD
The IT gave us the Recovery Key.

How can it decrypt the disk or the partition?

Re: Symantec Endpoint Decryption

April 28th, 2026, 11:49

:roll:.

Re: Symantec Endpoint Decryption

April 28th, 2026, 12:41

Code:
Symantec provides a Windows PE–based recovery environment specifically for situations like:

    Windows won’t boot

    The drive is removed from the laptop

    You have the recovery key

Symantec explicitly recommends not decrypting the disk unless absolutely necessary, and instead using the recovery environment to authenticate and access the data.

Process overview:

    Boot a Windows PE USB that includes the SEE Recovery Tools.

    Attach the cloned SSD (or the original).

    Enter the Recovery Key when prompted.

    The tool will mount the encrypted volume in decrypted form so you can copy files off.

This avoids irreversible decryption and preserves data integrity.

Re: Symantec Endpoint Decryption

April 29th, 2026, 15:54

Thanks, will try it

Re: Symantec Endpoint Decryption

April 29th, 2026, 20:01

Having trouble making a Bootable Windows PE USB that includes the SEE Recovery Tools.

Anyone can help me create it, please
Post a reply