MultiDrive – free backup, clone & wipe disk utility from Atola Technology

All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 6 posts ] 
Author Message
 Post subject: How to extract data from an encrypted drive KNOWING the PW?
PostPosted: June 2nd, 2009, 3:45 
Offline

Joined: February 11th, 2009, 6:54
Posts: 32
Location: Spain
Hello, I've been given an HP 3-in-1 docking station to recover data from it, and it's full of data but no disk scan recovered even a single file, so I took a look to the drive and it seems to be encrypted... (all I can see is the NTFS boot record). Then, the customer said me that he had to enter a password, so... the problem is that I don't know how to use that password (e.g. with WinHex) to recover the data, without asking for the docking station and the laptop to plug it...


Top
 Profile  
 
 Post subject: Re: How to extract data from an encrypted drive KNOWING the PW?
PostPosted: June 2nd, 2009, 5:47 
Offline

Joined: July 18th, 2006, 3:05
Posts: 7476
Location: ITALY
Use the same application that encrypted data. Simple.


Top
 Profile  
 
 Post subject: Re: How to extract data from an encrypted drive KNOWING the PW?
PostPosted: June 2nd, 2009, 6:16 
Offline

Joined: February 11th, 2009, 6:54
Posts: 32
Location: Spain
I have no idea how the docking station performs the encyption, there's nothing about the encryption type in the documentation, only "encrypting capability" (I'll keep searching, though). Moreover, the docking station seems to be burnt.
I've carved some MB with WinHex and now I can try to decrypt them using the password, but I don't know if it's an AES encryption or whatever... and neither the beginning of the encrypted area (might be after the boot record, but I really have no idea).


Top
 Profile  
 
 Post subject: Re: How to extract data from an encrypted drive KNOWING the PW?
PostPosted: June 2nd, 2009, 16:49 
Offline

Joined: May 16th, 2009, 9:32
Posts: 325
Location: UNited Kingdom
Is there just a single partition on the drive, or more than one?
Can you post an image or bin of the MBR/PT and boot sector of the partition

If it was in the docking station, then presumably it is a data drive and not the boot drive

Do you have the laptop that goes with it, to see what it does when it boots
eg if it runs some encryption driver or program


Top
 Profile  
 
 Post subject: Re: How to extract data from an encrypted drive KNOWING the PW?
PostPosted: June 3rd, 2009, 6:19 
Offline

Joined: February 11th, 2009, 6:54
Posts: 32
Location: Spain
Unfortunately, I don't have the laptop, and as I said I think the docking station is burnt. It's single-partitioned, and I can say that sector #0 contains NTFS partition information, sector #1 the NTLDR and it's mostly the same as another non-encrypted NTFS drive until sector #382, sector which seems to be the beginning of the encrypted area (analysing te data between #382 and ~#800 I get almost equal symbols probability).


Top
 Profile  
 
 Post subject: Re: How to extract data from an encrypted drive KNOWING the PW?
PostPosted: June 3rd, 2009, 6:50 
Offline

Joined: May 26th, 2008, 0:52
Posts: 40
I suspect it could be pointsec.
Try to insert the drive into any working computer as boot disk. If this is pointsec, you will see a screen prompting the passwords. Booting it up from a different hw could be difficult though.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 6 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Bing [Bot], Google [Bot] and 56 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group