Recover data from PGP encrypted hard disk

484 views
Skip to first unread message

jag

unread,
Jan 8, 2013, 6:32:19 AM1/8/13
to datarecovery...@googlegroups.com
Hi

I have a PGP encrypted windows disk that is not booting up. The hard disk itself is in working condition. Just need to recover data out of it. I have the encryption key. Anyone came across this before?. Please help

Cheers
-Jag

jag

unread,
Jan 8, 2013, 6:39:21 AM1/8/13
to datarecovery...@googlegroups.com
Addition Info

When I use PC3K, I get 
ATTENTION: Security Locked HDD

Tech Key...
Error starting command "En Tech" ABR

I am not able to do imaging using PC3K or DDI (DDI shows all A)

Is the HDD locked in addition to whole disk encryption ?

Cheers
-Jag

jag

unread,
Jan 8, 2013, 9:24:20 AM1/8/13
to datarecovery...@googlegroups.com
Managed to unlock the HDD using PC3000

Currently I can see the sector data, but since the disk is whole disk encrypted with PGP , unable to copy out data

Any suggestions?

Cheers
-Jag



On Tuesday, January 8, 2013 7:32:19 PM UTC+8, jag wrote:

Philip Shaw

unread,
Jan 8, 2013, 9:38:17 AM1/8/13
to datarecovery...@googlegroups.com
I was working with PC3K tech support on an encrypted drive (not PGP) and I believe they said there is no way to get the data while it is encrypted. I could be wrong on some level here but your best bet might be to Skype them and confirm.


Good luck,

Philip Shaw

--
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To view this discussion on the web visit https://groups.google.com/d/msg/datarecoverycertification/-/iL7B2vautPkJ.

To post to this group, send email to datarecovery...@googlegroups.com.
To unsubscribe from this group, send email to datarecoverycertif...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/datarecoverycertification?hl=en.

sup...@rambuscomputers.co.uk

unread,
Jan 8, 2013, 10:25:46 AM1/8/13
to datarecovery...@googlegroups.com

Alandata Recovery

unread,
Jan 8, 2013, 11:13:56 AM1/8/13
to datarecovery...@googlegroups.com
You need to download the pgp standalone boot disks - they are cd
images or floppies.
You need to find the version that matches the drive.
You need the use it to scan the disk looking for the keys,
Then enter the passphrase - and hope it unlocks.
Odds are good the passphrase will be communicated incorrectly... (Oh
CAPITAL A...)
Spend a day or two decrypting drive.

or plan B
Freeze live memory with liquid cryo...
Snag keys
Break encryption
bwahahahaha.....

--
Alandata Data Recovery - (949)287-3282
"Cleanroom Data Recovery of RAID, VMware, NAS, Linux, Tape, Disk, Forensics"
www.AlanData.com www.AlanDataRecovery.com
> --
> You received this message because you are subscribed to the Google Groups
> "DataRecoveryCertification" group.
> To view this discussion on the web visit
> https://groups.google.com/d/msg/datarecoverycertification/-/3kGB7S6OsvIJ.

sup...@rambuscomputers.co.uk

unread,
Jan 8, 2013, 10:19:36 AM1/8/13
to datarecovery...@googlegroups.com
This might be worth a read?

Loki

Sent from my iPhone 4S

jag

unread,
Jan 15, 2013, 5:34:05 AM1/15/13
to datarecovery...@googlegroups.com
Thanks everyone for the input

Thanks Loki for all your links and suggestions

The hard disk ATA locked, managed remove the lock using PC3K. 

Managed to get the PGP version number from the customer, it is v10.2.1

Downloaded v10.2.1 boot image and boot up the laptop. Started decryption. Decryption is running at the rate 1% per hour.

Estimated completion 5 days.

Cheers
-Jag



On Tuesday, January 8, 2013 11:19:36 PM UTC+8, Loki wrote:
This might be worth a read?

Loki

Sent from my iPhone 4S

On 8 Jan 2013, at 14:38, Philip Shaw <shawcomput...@gmail.com> wrote:

I was working with PC3K tech support on an encrypted drive (not PGP) and I believe they said there is no way to get the data while it is encrypted. I could be wrong on some level here but your best bet might be to Skype them and confirm.


Good luck,

Philip Shaw

On Tue, Jan 8, 2013 at 9:24 AM, jag <jag.k...@gmail.com> wrote:
Managed to unlock the HDD using PC3000

Currently I can see the sector data, but since the disk is whole disk encrypted with PGP , unable to copy out data

Any suggestions?

Cheers
-Jag



On Tuesday, January 8, 2013 7:32:19 PM UTC+8, jag wrote:
Hi

I have a PGP encrypted windows disk that is not booting up. The hard disk itself is in working condition. Just need to recover data out of it. I have the encryption key. Anyone came across this before?. Please help

Cheers
-Jag

--
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To view this discussion on the web visit https://groups.google.com/d/msg/datarecoverycertification/-/iL7B2vautPkJ.

To post to this group, send email to datarecovery...@googlegroups.com.
To unsubscribe from this group, send email to datarecoverycertification+unsub...@googlegroups.com.

--
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To post to this group, send email to datarecovery...@googlegroups.com.
To unsubscribe from this group, send email to datarecoverycertification+unsub...@googlegroups.com.

wayne horner

unread,
Jan 15, 2013, 11:49:59 AM1/15/13
to datarecovery...@googlegroups.com
how many tries did it take to get the correct passpharse from the customer?



To view this discussion on the web visit https://groups.google.com/d/msg/datarecoverycertification/-/aICrq7YPkKAJ.

To post to this group, send email to datarecovery...@googlegroups.com.
To unsubscribe from this group, send email to datarecoverycertif...@googlegroups.com.



--

jag

unread,
Jan 17, 2013, 2:59:32 AM1/17/13
to datarecovery...@googlegroups.com

Just one :)

Customer gave the correct password.

This is a 750GB hard disk and decryption is running for 5+ days still left 11% to decrypt. The hard disk is in good condition so I think the PGP decryption takes like 6 -7 days for 750GB disk

Cheers
-Jag

To unsubscribe from this group, send email to datarecoverycertification+unsubsc...@googlegroups.com.

--
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To post to this group, send email to datarecovery...@googlegroups.com.

To unsubscribe from this group, send email to datarecoverycertification+unsubsc...@googlegroups.com.

--
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To view this discussion on the web visit https://groups.google.com/d/msg/datarecoverycertification/-/aICrq7YPkKAJ.

To post to this group, send email to datarecovery...@googlegroups.com.
To unsubscribe from this group, send email to datarecoverycertification+unsub...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/datarecoverycertification?hl=en.



--

wayne horner

unread,
Jan 17, 2013, 4:59:07 PM1/17/13
to datarecovery...@googlegroups.com
processor speed is the limiting factor here



To view this discussion on the web visit https://groups.google.com/d/msg/datarecoverycertification/-/2R0Xy5GCccoJ.

To post to this group, send email to datarecovery...@googlegroups.com.
To unsubscribe from this group, send email to datarecoverycertif...@googlegroups.com.

sup...@rambuscomputers.co.uk

unread,
Jan 15, 2013, 1:54:25 PM1/15/13
to datarecovery...@googlegroups.com
Hope it all goes well mate. 
Decrypting from the cd will take ages. Its quicker if you have the correct software installed on a pc but then you got the cost of the software to think about. In the end I'm sure the customer will be very happy when you recover their data. 

Just out of curiosity did you image the encrypted drive after removing the password? I would of just to be on safe side. Better to have a backup of the encrypted data than none at all even if in the end you didn't need it. 


Loki

Sent from my iPhone 4S

To post to this group, send email to datarecovery...@googlegroups.com.
To unsubscribe from this group, send email to datarecoverycertif...@googlegroups.com.

sup...@rambuscomputers.co.uk

unread,
Jan 17, 2013, 5:07:16 PM1/17/13
to datarecovery...@googlegroups.com
Running from the decryption boot cd is also slower than installing the pgp software & running it from within an os.

Loki 

Sent from my iPhone 4S

sup...@rambuscomputers.co.uk

unread,
Jan 15, 2013, 6:48:31 AM1/15/13
to datarecovery...@googlegroups.com
Hope it all goes well mate. 
Decrypting from the cd will take ages. Its quicker if you have the correct software installed on a pc but then you got the cost of the software to think about. In the end I'm sure the customer will be very happy when you recover their data. 

Just out of curiosity did you image the encrypted drive after removing the password? I would of just to be on safe side. Better to have a backup of the encrypted data than none at all even if in the end you didn't need it. 


Loki

Sent from my iPhone 4S
On 15 Jan 2013, at 10:34, jag <jag.k...@gmail.com> wrote:


To post to this group, send email to datarecovery...@googlegroups.com.
To unsubscribe from this group, send email to datarecoverycertif...@googlegroups.com.

jag

unread,
Jan 19, 2013, 11:57:53 PM1/19/13
to datarecovery...@googlegroups.com
Yes I did imaging of the original disk with encryption after ATA lock removed.

Now the decryption is complete, it took 7 days to decrypt 750GB disk.

The disk is not getting in detected when I connect to system.  When I open the disk using PC3K, it shows empty below Root folder. I am now doing a scan on the PC3K, will update once the scan is complete.

Cheers
-Jag

Alandata Recovery

unread,
Jan 20, 2013, 12:53:42 PM1/20/13
to datarecovery...@googlegroups.com
it will be a bummer if they reinstalled. 
If it was re-encrypted with a different key then the previous files will be lost.
I dont know what pgp does if you encrypt twice using the same key. I suspect it would add some random salt
which would make 2 encryptions with the same key different.

Whats the date stamp of the files in the root?
Is it timestamped the day before they sent it for DR?



To post to this group, send email to datarecovery...@googlegroups.com.
To unsubscribe from this group, send email to datarecoverycertif...@googlegroups.com.



--

jag

unread,
Jan 23, 2013, 3:30:38 AM1/23/13
to datarecovery...@googlegroups.com
After the R-studio scan it came out as raw recovery. Able to get doc, xls, ppt, and jpeg and required by the customer as raw recovered files.

For some reason PC3K scanning did not complete and PC3K hang towards the end, so I mounted the drive as task drive using PC3K and then did a r-studio scan

Too bad unable to get a normal recovery

Cheers
-Jag
To unsubscribe from this group, send email to datarecoverycertif...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/datarecoverycertification?hl=en.

--
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To post to this group, send email to datarecovery...@googlegroups.com.
To unsubscribe from this group, send email to datarecoverycertif...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/datarecoverycertification?hl=en.
--
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To view this discussion on the web visit https://groups.google.com/d/msg/datarecoverycertification/-/aICrq7YPkKAJ.
To post to this group, send email to datarecovery...@googlegroups.com.
To unsubscribe from this group, send email to datarecoverycertif...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/datarecoverycertification?hl=en.
--
You received this message because you are subscribed to the Google Groups "DataRecoveryCertification" group.
To view this discussion on the web visit https://groups.google.com/d/msg/datarecoverycertification/-/1b97ZnL9zYMJ.

To post to this group, send email to datarecovery...@googlegroups.com.
To unsubscribe from this group, send email to datarecoverycertif...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/datarecoverycertification?hl=en.
Reply all
Reply to author
Forward
0 new messages