Thanks again for now, and I hope I can ask for your help when I get that drive decrypted, hopefully
next week.
Chris

If sector 72 is identical to sector 64, then these would be the first sectors in each of the two copies of the FAT.

_________________
A backup a day keeps DR away.

Yes they are identical...so what does that mean ?

Do we have, can we find copies of NTFS ?
What happened to all those Wkindows files, emails etc ?
If they decrypt the drive, can I try to install Windows XP over this clone drive ?
Wouldn't Windows fix at least some of the problems ? Like MBR, bootsectors ?
Is it possible ?

One more thing when I scroll in DMDE to the last sector there is some data everywhere.
I see most 0's from sector 63-80 and after that there is stuff.
Sorry for not being very technical here.

I see what has happened.

The original encrypted NTFS boot sector at sector 63 has been replaced by FIXBOOT with a FAT12 boot sector. Sectors 64 to 71, and 72 to 79, are two copies of a FAT which has probably also been created by FIXBOOT, although this didn't happen in my case.

My plan of attack would be to make an unencrypted sector by sector clone of the drive (is this possible ??), then work on the clone. First restore sector 63 from the backup at sector 312576704. Then write zeros to sectors 64 through 79. This will prevent the bogus data from confusing your data recovery software. Now run your data recovery software against the clone.

Don't write anything else to the drive. You'll only make things worse.

_________________
A backup a day keeps DR away.

No I am not writing anything to the original , as a matter of fact it is in my possession stored away.
I kept the original since IT people sometimes have got not time to do all this staff and go
for fresh install.

I think they are trying to restore it but no word on it yet.
It would be funny if your method worked and theirs failed ???

I will clone it again and then ask IT to unencrypt the clone (I don't see why they would not
do it , it is a company laptop but nothing "mission critical on it".)
We have to wait till next week until I get all that done .
Thanks for now, we'll talk next week .

Happy Easter (if you celebrate ?) or Happy Holidays or Have a Great Weekend !

Thanks again, (wish I had your knowledge)!

So you have a sector by sector clone of the drive, in encrypted form, before it was damaged? If so, then that could be all you need.

Could we see sectors 63-80 of that clone?

_________________
A backup a day keeps DR away.

BTW, I suspect that you may only need to repair sector 63 to be able to access your data, but you would need to repair the other sectors in order to boot from the drive.

_________________
A backup a day keeps DR away.

I have the original drive from the computer in encrypted form however FIXBOOT was ran on that drive
(so it is damaged by FIXBOOT).
Sorry if I caused some confusion here.

You might like to build a new drive in exactly the same way as the damaged one, with the same password. Then we could examine sectors 63-80 and potentially use them to repair the damaged drive. At the very least it would help us understand the structure a little better.

_________________
A backup a day keeps DR away.

This story has a ending.
My IT guy got back to me and he was able to remove encryption from the drive.
My data seems to be untouched (email, few photos)...
WindowsXP seems to have a few problems (especially different drivers ), it is unusable in this state.
I will copy my data to a new drive and IT will re-image my computer again.
Frank, sincere thanks for your help.

I do have 2 drives that failed on me a few years back (again not that important)
but would like to give it a shot and try to recover data from them , so I will visit
this forum in the future.
Thanks again !

To ensure you never have to go through data recovery operations. Learn how to do backups.

_________________
On a clear disk you can seek forever.

good advice Keatah, if you do not want to meet DRguy make a good backup