dimaj Posted October 4, 2010 Share Posted October 4, 2010 Hey guys! I have a huge problem which I desperately need help with... Me, being as stupid as I am, never backed up my HDD, which is encrypted with GuardianEdge. (It's my work computer). Last night I though it would be a great idea to install Ubuntu 10.04 on SDHC card, so that I could plug it in into any computer and get my linux environment. What I didn't realize is that during installation my MBR got overwritten and grub was installed. This morning, I came to work (all happy that I have linux on SD card) and was greeted with a happy grub prompt. At that point, I thought it would be a good idea to restore my NTLDR. So, I ran ms-sys -m /dev/sda from Ubuntu LiveCD. After reboot I was greeted with even happier message "Error loading operating system." I suspect that my MBR was also encrypted and after MBR has been overwritten, I can no longer decrypt my main partition for booting purposes. So, here comes the question... is there any way to recover some data from that hard drive? I've worked for 3 weeks on a project (no backups and not checked in) and I really don't want to do it over again. Any help and ideas are appreciated. dimaj Quote Link to comment Share on other sites More sharing options...
Infiltrator Posted October 5, 2010 Share Posted October 5, 2010 You can give this tools a try, but I am not 100% certain whether you will be able to retrieve your data, since you have already installed a different file system. You will need to install your HDD onto another machine, in order to try to restore the files. http://www.cgsecurity.org/wiki/TestDisk http://foremost.sourceforge.net/ http://www.digitalforensicssolutions.com/Scalpel/ Quote Link to comment Share on other sites More sharing options...
antonymous Posted October 15, 2010 Share Posted October 15, 2010 Did you ever have any luck with this? I have some experience with data recovery from encrypted partitions, and it's nice to see followups. From my experience however, once your encrypted MBR has been overwritten, you're pretty much out of luck, assuming GuardianEdge is configured for whole-disk encryption. The tools linked to above are good for file carving, but are useless if you can't decrypt the disk. I've even been on the phone with GuardianEdge when a client's MBR became corrupted, and they weren't able to help me. Wish I had better news for you! Let us know if you're able to recover anything and what steps you took... Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.