Data recovery for corrupted disks with PGP Whole Disk Encryption

[DonH]

Hi,

I've got a disk that currently appears to have a corrupted NTFS MFT, (among other problems).

This disk is a Samsung 2.5" SATA 320GB with a single bootable NTFS partition and WinXP SP2 installed. Corporate security policy dictates that we have PGP Whole Disk Encryption (WDE) installed as well. I recently went through increasingly frequent BSOD's until it finally hung on reboot after a BSOD. Trying to boot from the disk after that resulted in boot time chkdsk generating unreadable file messages and hanging the machine.

Thinking to recover the data using a boot CD and xfer my data to a good USB disk, I attempted to decrypt the bad disk using a PGP recovery disk. This too hung without completing the decryption.

I then installed the bad disk into a external USB case and booted from another XP installation that had PGP installed. At this point I was able to view the failed disks directory structure and files. I then started to copy the data from the failed disk to another good USB hdd. This process started and subsequently failed after about 12 hours. I didn't recover all the important data.

The bad disk now reports corrupt MFT and XP complains the disk structure is corrupted and unreadable.

Because the disk is still ~99.5% encrypted I strongly suspect I have to work through XP which has the PGP software installed. As a result I'm not sure what recovery tools are the most appropriate to use.

I also think the disk has bad sectors.

I've prepared a Disk Patch bootcd but have not run it against the disk, as DP will potentially be reading encrypted data. I'm currently using iRecover to make an image of the bad disk on a second USB 320GB with iRecover installed on the good winXP image.

I'm now out of my depth here and looking for suggestions.

Lessons learnt so far;
 1. A 2 month old backup is not good enough.
 2. When the machine begins to BSOD it's time for a full backup! - Sometime I just don't listen...
3. PGP WDE is a PITA!

TIA for any help.
Don H

[Joep]

Hello,

I then installed the bad disk into a external USB case and booted from another XP installation that had PGP installed. At this point I was able to view the failed disks directory structure and files. I then started to copy the data from the failed disk to another good USB hdd. This process started and subsequently failed after about 12 hours. I didn't recover all the important data.

The bad disk now reports corrupt MFT and XP complains the disk structure is corrupted and unreadable.

Because the disk is still ~99.5% encrypted I strongly suspect I have to work through XP which has the PGP software installed. As a result I'm not sure what recovery tools are the most appropriate to use.

Try running iRecover and see if it detects the mounted encrypted disk. If so, try scanning it.

[DonH]

Hi Joep,

Thank you.

I've run iRecover in scan mode. The first two passes look promising with some green & blue found and one bad block found near the start. During the third pass PGP will pop up requesting the passphrase for the drive. As soon as this happens iRecover begins to find nearly everything as a bad sector. I re-enter the passphrase, but iRecover continues to mark virtually al the drive as bad and at some interval after this occurs iRecover will exit without warning.

I've been wondering if I could try mirror the bad disk to another good disk using a low-level utility like dd and continue to work on the mirrored image from a good disk? (Assuming of course the disk is bad).

Thanks again,
Don H

[Tom]

Well, a good way (in this case) to figure out if the drive IS bad, is to run DiskPatch and run a surface scan. And a health report, if possible. DiskPatch operates without windows so in that regard it won't care what's on the disk, it just accesses the disk raw. Just don't do any repairs. You can use the trial version for the surface scan and health report. Info here:
http://www.diydatarecovery.nl/dp_manual/guide_surfacescan.htm
http://www.diydatarecovery.nl/dp_manual/guide_smartcheck.htm

And if that info comes up clean, you'll know the cause for the failed scan lies somewhere else.

Please note: if that surface scan DOES find loads of errors you should abort it, because at that point the disk might be in bad shape. So then you would have to clone it a.s.a.p.