Jump to content

PC turned off in the middle of the encryption process, encryption process not completed


Walter Vergara
Go to solution Solved by Walter Vergara,

Recommended Posts

 

Hi ,Can you recover information or start the encryption process again on a PC that was forced to shut down halfway through the process?

Relevant data: The device does not appear in the console; it does not boot the operating system.

Link to comment
Share on other sites

  • ESET Staff

Hi @Walter Vergara,

If the Disk doesn't have any important data on it, it would be quickest to simply format the Disk via Diskpart -> Clean commands via a WIN RE USB and reinstall the Windows OS.

However, if the data is important and you would like us to advise you on the best potential path of recovery, we will need the following:

Would you be able to submit a ticket via: https://www.eset.com/int/about/contact/ with the following logs please:

https://support.eset.com/en/kb7894-eset-encryption-recovery-utility-diagnostics#SearchForMeta

These logs will acquire all the data we should need to inform you of what can be done next.

Thank you.

Link to comment
Share on other sites

  • ESET Staff

Hi @Walter Vergara,

Would you be able to submit a ticket via with all of this information and with the questions below answered please: https://www.eset.com/int/about/contact/

This will likely need a Developer to investigate, the state of the disks look strange to me. Disk 1 (Samsung SSD 970 EVO Plus 1TB) looks like it is Bitlocker Encrypted and not Encrypted by EFDE at all. 

Disk 0 (Micron_2400_MTFDKBA512QFM) looks like encryption started and got most of the way, possibly around ~77% but difficult to be sure without a Developer looking at this and confirming.

However I notice when you attempt to 'Decrypt' you get the following error:

Decryption data failed.
If you are using a recovery file please verify it is for this computer. (0x16)

  • Are you 100% sure that the EFDE Recovery File being used is for this Computer?

If you are, it is likely we will need to create some sort of script to help decryption start on Disk 0 (Micron_2400_MTFDKBA512QFM). Hence another reason for the the request of a ticket.

  • However, might I ask what happens if you remove Disk 1(Samsung SSD 970 EVO Plus 1TB) and attempt decryption again with only Disk 0 (Micron_2400_MTFDKBA512QFM) installed?

Thank you.

Link to comment
Share on other sites

Hi again,

 

First of all, thank you for the help provided, is there any way to obtain the device ID in order to identify the PC to start a process of recovering the information through an alternative means such as scrip?

Link to comment
Share on other sites

  • ESET Staff

Hi @Walter Vergara,

Yes you can ensure the correct Recovery File is being obtained via the EP Console -> Help menu -> Encryption Recovery -> Recovery Data and Enter the following Workstation ID obtained via the Recovery Files provided in your prior reponse:

14/12/2023-00:37:18 : Workstation ID : 358F5781-904A-11EE-A31F-F4C88AD68C2D

If you obtain this and the 'Decrypt' attempt still fails, submit a ticket with all of the details and we shall discuss this further then as I cannot provide any sort of solution that would potentially require a script via the ESET Forum I am afraid. Thank you.

Link to comment
Share on other sites

  • 2 weeks later...
  • ESET Staff

Hi @Walter Vergara,

Would you mind requesting that they escalate your ticket to HQ with these logs and screenshots provided. In addition could you provide this log: https://support.eset.com/en/kb7894-eset-encryption-recovery-utility-diagnostics#SearchForMeta

I shan't be able to help you on the forum with this specific issue as it will require investigation by our team with the logs above and the logs already provided, and thus may require a script to allow decryption to start which I cannot provide here.

Thank you,

Kieran

Link to comment
Share on other sites

That would be very helpful to me, it is not a problem to send the logs. Here I send you the Recovery logs (https://support.eset.com/en/kb7894-eset-encryption-recovery-utility-diagnostics#SearchForMeta)

 

*In addition, I place the respective logs and prints separately in the process 1 and 2 folders.

Thank you for your Help Kieran!

Recovery logs.rar Process 1.zip Process 2.zip

Link to comment
Share on other sites

  • ESET Staff

Oh amazing, I see you already acquired some. Please request that the agent you are speaking with at ESET Latam escalate this ticket to HQ (Specifically to the Encryption Solutions team) or if you rather provide me with the agents contact details so I can request they do it on your behalf so I can handle this directly with the Encryption Solution Developers for you.

Thank you,

Kieran

Edited by Kstainton
Link to comment
Share on other sites

  • ESET Staff

No worries, @Walter Vergara happy to help, as soon as it is escalated to my team by the team you are communicating with in ESETI will do my best to provide you with a solution as soon as possible, but nothing stands out as the cause for the failure so I want to run this by an Encryption Developer so to provide the best solution.

Link to comment
Share on other sites

  • 2 weeks later...
  • ESET Staff
Posted (edited)

No worries at all Walter, glad it is all sorted, we got together with the team working on this and helped them with a solution :D

Edited by Kstainton
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...