PC turned off in the middle of the encryption process, encryption process not completed

[Walter Vergara 3]

 

Hi ,Can you recover information or start the encryption process again on a PC that was forced to shut down halfway through the process?

Relevant data: The device does not appear in the console; it does not boot the operating system.

[Kstainton 35]

Hi @Walter Vergara,

If the Disk doesn't have any important data on it, it would be quickest to simply format the Disk via Diskpart -> Clean commands via a WIN RE USB and reinstall the Windows OS.

However, if the data is important and you would like us to advise you on the best potential path of recovery, we will need the following:

Would you be able to submit a ticket via: https://www.eset.com/int/about/contact/ with the following logs please:

https://support.eset.com/en/kb7894-eset-encryption-recovery-utility-diagnostics#SearchForMeta

These logs will acquire all the data we should need to inform you of what can be done next.

Thank you.

[Walter Vergara 3]

Thanks for the quick response, testing the solution. When I have feedback I will share it

[Kstainton 35]

No worries at all @Walter Vergara

[Walter Vergara 3]

Hi again,

These are the logs sent, but I think they are the process recovery logs. Could you analyze them? thank you in advance
 

Recovery logs.rar

[Kstainton 35]

Hi @Walter Vergara,

Would you be able to submit a ticket via with all of this information and with the questions below answered please: https://www.eset.com/int/about/contact/

This will likely need a Developer to investigate, the state of the disks look strange to me. Disk 1 (Samsung SSD 970 EVO Plus 1TB) looks like it is Bitlocker Encrypted and not Encrypted by EFDE at all. 

Disk 0 (Micron_2400_MTFDKBA512QFM) looks like encryption started and got most of the way, possibly around ~77% but difficult to be sure without a Developer looking at this and confirming.

However I notice when you attempt to 'Decrypt' you get the following error:

Decryption data failed.
If you are using a recovery file please verify it is for this computer. (0x16)

• Are you 100% sure that the EFDE Recovery File being used is for this Computer?

If you are, it is likely we will need to create some sort of script to help decryption start on Disk 0 (Micron_2400_MTFDKBA512QFM). Hence another reason for the the request of a ticket.

• However, might I ask what happens if you remove Disk 1(Samsung SSD 970 EVO Plus 1TB) and attempt decryption again with only Disk 0 (Micron_2400_MTFDKBA512QFM) installed?

Thank you.

[Walter Vergara 3]

Hi again,

 

First of all, thank you for the help provided, is there any way to obtain the device ID in order to identify the PC to start a process of recovering the information through an alternative means such as scrip?

[Kstainton 35]

Hi @Walter Vergara,

Yes you can ensure the correct Recovery File is being obtained via the EP Console -> Help menu -> Encryption Recovery -> Recovery Data and Enter the following Workstation ID obtained via the Recovery Files provided in your prior reponse:

14/12/2023-00:37:18 : Workstation ID : 358F5781-904A-11EE-A31F-F4C88AD68C2D

If you obtain this and the 'Decrypt' attempt still fails, submit a ticket with all of the details and we shall discuss this further then as I cannot provide any sort of solution that would potentially require a script via the ESET Forum I am afraid. Thank you.

[Walter Vergara 3]

Yes its  all ready scaled by a ticket , Thanks for your help. I will share information about  how its going. 

[Kstainton 35]

Amazing, do you have a case number I can take a look at ?  

[Walter Vergara 3]

 790856  It is from ESET latam, they escalated it to the company developers.  

[Kstainton 35]

Oh I see! Not in my system yet in that case, we shall leave it to them 

 

Edited December 15, 2023 by Kstainton

[Kstainton 35]

Hi @Walter Vergara,

Would you mind requesting that they escalate your ticket to HQ with these logs and screenshots provided. In addition could you provide this log: https://support.eset.com/en/kb7894-eset-encryption-recovery-utility-diagnostics#SearchForMeta

I shan't be able to help you on the forum with this specific issue as it will require investigation by our team with the logs above and the logs already provided, and thus may require a script to allow decryption to start which I cannot provide here.

Thank you,

Kieran

[Walter Vergara 3]

That would be very helpful to me, it is not a problem to send the logs. Here I send you the Recovery logs (https://support.eset.com/en/kb7894-eset-encryption-recovery-utility-diagnostics#SearchForMeta)

 

*In addition, I place the respective logs and prints separately in the process 1 and 2 folders.

Thank you for your Help Kieran!

Recovery logs.rar Process 1.zip Process 2.zip

[Kstainton 35]

Oh amazing, I see you already acquired some. Please request that the agent you are speaking with at ESET Latam escalate this ticket to HQ (Specifically to the Encryption Solutions team) or if you rather provide me with the agents contact details so I can request they do it on your behalf so I can handle this directly with the Encryption Solution Developers for you.

Thank you,

Kieran

Edited December 27, 2023 by Kstainton

[Walter Vergara 3]

Thank you for your help, the energy you give is admirable! and sorry for the insistence!

[Kstainton 35]

No worries, @Walter Vergara happy to help, as soon as it is escalated to my team by the team you are communicating with in ESETI will do my best to provide you with a solution as soon as possible, but nothing stands out as the cause for the failure so I want to run this by an Encryption Developer so to provide the best solution.

[Walter Vergara 3]

Hello, here again. The client was able to remove the encryption with the pendrive tool after trying several times. Thank you very much for all the help provided!

[Kstainton 35]

No worries at all Walter, glad it is all sorted, we got together with the team working on this and helped them with a solution 

Edited January 8 by Kstainton