Re: Anyone knows about McAfee Enrcyption? (Have password)

[Data Recovery Guru]

Since you have a donor, I would test/experiment how the encryption/decryption shulould work. Then once we understand that clearly, then we can replicate on the patient.

On Fri, Jul 12, 2024, 7:15 AM Francisco <equipoel...@gmail.com> wrote:

Long story short, one day the user gets an error using his Toshiba USB hard disk. He apply chkdsk and later he cannot get access to his files.

I check the chkdsk logs and see several files moved from original locations.

The main exe (MfeEEERM.exe) and the mxfecc32.dll were missing.

I was able to get a fresh copy of this file and the dll from another working disk.

I also have all the files from the folder McAfeeEERM(encrypted content).

I have the original password.

I was able to do a full image and now trying to get the files from that.

I already paste the exe and dll to root and get the main window asking me for the password. I type it twice and get a window with desktop folder empty.

After a R-Studio scan, I also found some recycle bin folders and files, some from a folder called xxxxx.app.

Within another working disk I see a folder called McAfee Removable Media Protection.app (not present on the damaged disk).

I also search (and found) a similar structure on damaged disk, with only one difference in the name of the folder.

I already copy-paste the original folder found on recycle bin (didn't work), also copy-paste the recovered folder to root/McAfee Removable Media Protection.app/ (didn't work), and also copy-paste the recovered folder to root/McAfee Removable Media Protection.app/edm (original route, didn't work).

At all times I can run the program, type the password and get access to same empty desktop folder within the McAfee program.

I was even able to change the password from that program. But I cannot get access to data, not even an error message.

Any ideas?

Thanks all in advance.

--
Data Recovery Certification Group / for issue with google group please email sc...@myharddrivedied.com
---
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To unsubscribe from this group and stop receiving emails from it, send an email to datarecoverycertif...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/datarecoverycertification/4a1c0b14-eb15-4024-8905-dae7d2bd239cn%40googlegroups.com.