backup hard drive question

[kapkomet]

I have a friend who backed up their laptop to a portable hard drive.

 

Their hard drive crashed on the laptop, and he re-installed the OS on the laptop.

 

Now, when he goes to the portable hard drive, it doesn't recognize anything on the portable (I would presume because it's encrypted)...

 

Anyone have any ideas to get to the data?

 

[southsideirish71]

I have a friend who backed up their laptop to a portable hard drive.

 

Their hard drive crashed on the laptop, and he re-installed the OS on the laptop.

 

Now, when he goes to the portable hard drive, it doesn't recognize anything on the portable (I would presume because it's encrypted)...

 

Anyone have any ideas to get to the data?

 

If he encrypted the portable with another application, such as truecrypt, then he will need to reinstall the Encryption program and use it to mount the portable. Truecrypt for example, mounts drives through its application with a shared secret password or keyring. If I was to plug that into another machine it would look unrecognizable. Most encryption applications will allow you to backup the keys to another medium for use for repair or utility access. This is specifically for disasters like this. If this is not the case, then he might have a problem. Most of these encryption programs are encrypted with a pretty strong algorithm such as AES, Twofish, Blowfish, etc. Brute forcing it is not an option. And data recovery doesn't work on encrypted drives for the most part.

 

If its not encrypted, you can either mount it manually on a Linux machine and look at the data ( maybe the volume header is trashed ), or try a data recovery utility

 

Has he every used this portable drive on another machine?

Edited February 27, 2009 by southsideirish71

[kapkomet]

This is a windows machine - not linux or anything like that.

 

He used it on his laptop - backed it up - then reinstalled XP straight on the laptop. As far as a I know, he didn't hook up to another machine.

 

So it sounds like he just needs to reinstall the encryption software?

 

He said when he went to go to the backup drive, windows wouldn't recognize it, if I am remembering right.

[southsideirish71]

This is a windows machine - not linux or anything like that.

 

He used it on his laptop - backed it up - then reinstalled XP straight on the laptop. As far as a I know, he didn't hook up to another machine.

 

So it sounds like he just needs to reinstall the encryption software?

 

He said when he went to go to the backup drive, windows wouldn't recognize it, if I am remembering right.

 

The encryption software probably mounts the drive outside of the normal windows process. So a reinstallation of that is the first step, and see if it now recognizes the drive after that.

 

 

 

[RockRaines]

Windows should still recognize the drive, most portable hard drives launch an installer of their software when plugged into a new PC, which it would appear to be since it has a whole new OS.

[kapkomet]

I think it recognizes the drive but it acts like nothing's on it (it can't see the files).

 

[longshot7]

I love Diskwarrior to retrieve stuff. Has he tried anything like that?

[kapkomet]

Not sure. I'll actually point him to this thread for some ideas.

 

[southsideirish71]

Windows should still recognize the drive, most portable hard drives launch an installer of their software when plugged into a new PC, which it would appear to be since it has a whole new OS.

 

Most portable drives are formated as FAT or NTFS and work as you say. Your OS will recognize the USB drive, load the drives and then will auto-mount it. If the portable disk was encrypted as a whole, then thats an entirely different matter. Then when the system mounts it, it will see garbage and will attempt to format it or it won't read it at all.

 

Now if the drive isn't encrypted, and maybe the partition table is corrupted or was formatted accidentally. Then he could use a utility like Recover my files, or something else to recover the data. It can also recover the partition as well.

[kapkomet]

So I told my friend to look at this thread to see if anything popped out:

 

He told me the following:

 

I see all file names, size, etc. Everything is in green, indicating it's been encrypted. I never installed an encryption program on my machine. I'm assuming windows XP encrypts files on the fly based on security level? I never envoked an encryption program to my knowledge, but when I look at the properties on any of the files, the encryption block is checked. When I try to access any of the files, it tells me "access denied".

 

So that tells me that everything can be read, and yet, I'm sort of confused about that... could it be some type of "key" issue? That's what I was reading earlier, but that doesn't make sense to me.

 

If it can be read and he can see all the information - then it's a matter of pulling that data, I think.

 

Any ideas?

 

[southsideirish71]

So I told my friend to look at this thread to see if anything popped out:

 

He told me the following:

 

 

 

So that tells me that everything can be read, and yet, I'm sort of confused about that... could it be some type of "key" issue? That's what I was reading earlier, but that doesn't make sense to me.

 

If it can be read and he can see all the information - then it's a matter of pulling that data, I think.

 

Any ideas?

 

Windows XP had a feature called Encrypting File System and when you list the files it shows up green. That could be the culprit. But its not something that is turned on by default so its kind of odd that your friend would run into this. Hell I have never seen a machine yet with this enabled and people using it to encrypt data.

 

http://en.wikipedia.org/wiki/Encrypting_File_System Lots of Links at the bottom of this.

 

Here is a product that might help give the demo a copy. I have used their password cracking programs at work, never this particular product. Haven't run into EFS at all. http://www.elcomsoft.com/aefsdr.html

 

Hope this helps.