Recovery media fails to boot with error on ntoskrnls.exe

[Ovidiu 0]

Hi everyone,

Running into some issues with the recovery media, when trying to boot from it.

I've created an ISO image using the recovery media creator tool, latest version available downloaded from ESET website. The image is for EEES Managed.
When booting from it, after about 30 seconds, the recovery environment fails with blue screen and error 0xc000a004 regarding ntoskrnls.exe. I've attached a screenshot to this thread.

I have also tried creating a USB flash drive instead of the ISO image. Also tried it on multiple machines, downloading the tool separately on each one. Even tried on a machine without antivirus software installed, as I found an older post here where the file above was marked as a false positive. Both ISO and direct USB flash drive fail to boot on multiple machines (Legacy & UEFI), and in virtual machines.
When building ISO image, the size of it is different each time a new one is created, by around 10-15 MB, which is very strange considering I am using the exact same options to create it and the exact same tool downloaded from ESET website.

Is there an issue with the current tool? Is there an older version of it I can use to create the ISO/USB recovery media?

Thank you

[Kstainton 31]

HI @Ovidiu,

I have not seen this issue before.

May I ask the reason for attempting decryption via the ESET Recovery Media Creator, what issue are you having with your EEE Client machines?

I assume by your message you are following: https://support.eset.com/en/kb7160-decrypt-a-managed-system-that-is-unable-to-start-windows

If that is the case, if you disable 'Secure Boot' on the machines you are attempting to decrypt and create the ESET Recovery USB via the Creator Tool as a 'EFI USB 32 & 64 bit' instead of using the WIN RE methods. Does this allow you to boot to the USB and decrypt as expected?

Thank you,

Kieran

[Ovidiu 0]

HI @Kstainton and thanks for your reply.

This was part of a data recovery job. The laptop the NVMe drive came from had been damaged. The drive also had some issues. We were able to fully image it, and we needed to decrypt the image so that we could extract the data for our customer, who use ESET encryption in their company.

I did manage to decrypt the image using the EFI USB 32 & 64 bit, but after a few tries. The GUI version failed to load when the image drive was connected to the machine, and the text mode version failed to decrypt the drive midway. Tried it on 2 different machines, both with Gigabyte motherboards, BIOS reset to default settings. In the end I tried it on a computer with an ASUS motherboard, which worked using GUI version but only in performance mode.

We rarely deal with ESET encryption, as most of our customers prefer to use other solutions. However I will say that getting to the point where this drive was decrypted, was a process a lot longer than it had to be, and with so many issues with the recovery environment. It's unnecessary difficult just to get the process going.

All the best!

[Kstainton 31]

Hi @Ovidiu,

Thank you for letting us know. Looking into this with the Development Team, this looks to be an issue with the Windows Recovery Environment which we utilize using our WIN RE option of the ESET Recovery USB to help allow customers using Legacy BIOS Mode machines 'Decrypt' their Workstations as well as providing another option to UEFI BIOS Mode machines.

I will continue looking into this with the team, but it seems like an issue that Microsoft are hopefully going to resolve and it is unfortunate our ESET Recovery USB WIN RE tool can be affected by this.

We can see other forums online that report similar issues with the Windows Recovery USB.

Thank you.