HDD GURU FORUMS

Can you pl suggest the best suitable and reliable software for disk imaging for the data recovery purposes?
I don't want to disturb the corrupted or damaged disk but would like to take an image - byte by byte sector by sector so that i can analyze the disk and then decide the next step.
Can you also provide me how or what software to use to recover any hard disk that is whole disk encrypted with safeguard easy?

Indi

If the drive is working fine, partition saving is free and good.
If the drive is damaged you will need more expensive software like media tools or if possible hardware cloning machine (expensive).
Foe recover a disk encrypted with safeguard easy, clone it and decrypt the clone with the key.

Well not to duplicate my earlier posting at
fujitsu-encrypted-hdd-data-recovery-t12181.html
The actual issue for which I had posted this query is to resolve a very particular situation I am facing now detailed at above URL.
In case any near perfect solution can be found pl mark me advised with your valuable solutions.

Tx
indi

If the drive itself isn't damaged and the damage is only logical (deleted partition), you can clone the drive to another one using the free partition saving from here :
http://partition-saving.com/
But you will need some software or emergency disc created by Safeguard Easy
so that you can provide the key and force decryption of the drive, otherwise other recovery software like testdisk will not even see the data, because it's encrypted and for those logic recovery softwares out there they will see "garbage" and not legit data.
Clone the drive and decrypt it first.
After that you can try to get the data out.

Yes already have the image and yes all the software that was used are showing only junk. Is it recoverable or one and the same when using the recovery software on an image ?? Ofcourse its a well known fact that image is the best alternative to run or a kinda test bed, just clearing myself in case of this safeguard scenario pl. Any ideas ??

It's recoverable but you have to decrypt first.
Until you decrypt the disk no tool will be able to extract data from it.
That is the point of encryption anyway ....
The idea of the encryption is scramble the data in a way that no-one will be able to do anything with it until the decryption is made. When you provide the key an on-the-fly decryption is done.
You have to force decryption on the image/clone. Your clone is an exact copy of the damage disk, so it's encrypted also. As soon as you decrypt it you will be able to play with all the data recovery tools that you wantand they will work fine.

since the primary partition c:\ was deleted by he IS folks can u help me on how to recover that partition so that I can reestablish that partition and decrypt so that I can get my data back pl !?? I meant can u guide me pl !!!

You are going to need to purchase a good partition restore program. Something like Partition Doctor or another one. Do not use a free program purchase one to use you can find some good one on internet do a search and you will find one that will help you

since the primary partition c:\ was deleted by he IS folks can u help me on how to recover that partition so that I can reestablish that partition and decrypt so that I can get my data back pl !??

Decrypt first !!!! Force the decryption and decrypt allways first. Only than the tools will be able to work with the data, otherwise for any tool a encrypted drive will no be seen as data.

Do not use a free program purchase one to use you can find some good one on internet do a search and you will find one that will help you

Testdisk is one of the most powerfull partition tools that i've ever come across, and it's free. Just image the drive and experiment with your clone drive.

Good advice decrypt first but if you do not see partition it is not possible. First find partition then you can decrypt. Partition normally are not crypted. You can try WinHex to see the signature of your partition. This might tell you if partition is really deleted or it is still there and you are having problems seeing it. It can also show you data on your drive. Normally I use partition recovery software but never tried test disk you can give that a shot to see if it works before buying software

First find partition then you can decrypt.

And how do you intend to find the partition? If the drive is fully encrypted there is no way to see any data, it will all look like random characters !

Safeguard and most other disk encryption software still need a standard partition table. The MBR code may be different as the start offset for the boot loader may be differnet and the encryption key may be either in the MBR or the boot sector.

If the partition is in a container file, then you would only need to pull off the container and apply the software password to access the virtual drive in the container.

Thanks all for your advices and there we are SCRATCHY u CATCHY my point ... This is where I need help in resolving the partition table. Unless I restore the deleted partition I can neither proceed or use any safeguard key to decrypt and then recover encrypted data. Can you help me out??

Indi

Hope is like a cloud sometimes it rains...
sometimes it passes away with a gentle smile

Partition doctor is a very good one to rebuild partitions with. Then you can decrypt the disk after wards. You can also check with WinHex to see the start of your partition signature. Linux Live CD also has some very good functions inside of this for your problem

I have had really good luck rebuilding partition with Partition doctor. It has saved me a lot of time using this software. You will need to rebuild the partiton before decrypting this drive. You need the partition before you can run your program. Even if you try to decrypt before rebuilding the partitons that has been deleted you will get nowhere. Get a good partition software to help you find your missing partition. Good luck on this one

If the drive is encrypted with SafeGuard no "partition recovery" software will be able to find or rebuild the partition. Most of them work by finding BIOs parameter blocks and Master File Tables all of which will be encrypted. If you lost the MBR things get more complicated, Safeguard stores information on the MBR which is needed to decrypt the drive, among other things it stores a value that points to where the on the drive the security kernel is. Without the security kernel you won't be able to decrypt the drive, did you get 100% of the drive? if you didn't manage to get the sectors that contain the security kernel then you have to restore it from a .svf file (which is created from a backup of the kernel).
To do all of this you need to use a Safeguard Bootable Rescue Image for the right version of Safeguard. you can either use a floppy disk or a bootable cd.

Regards

@littlendian


No-One will believe untill all partition-recovery software in the world (including warez) is used on the drive.