Sunday, August 2, 2009

IF your PGP WDE 9.x boot disk does /NOT/ boot.

This is the step-by-step guide to recover your PGP WDE encrypted boot disk, in case it refused to boot. The article from PGP Support Forum.

Bottom line - I have my disk back. I post the steps I took below for others to read. Please comment / change anything which I may have not explained correctly. I wanted to be a little more verbose in case others had a similar issue so I have had to post this in two separate postings. Many thanks to you and the folks at PGP for your assistance.

1) After your previous post I put the laptop in Target Disk mode and connected it via firewire to the other Laptop with PGP installed.

2) Upon opening a Terminal session it was clear that the disk was not repaired as the hexdump -C -n 128 /dev/rdisk1 and hexdump -C -n 128 /dev/disk1 commands did NOT show PGPGUARD as shown here:


Musashi:~ go$ diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *111.8 Gi disk0

1: EFI 200.0 Mi disk0s1

2: Apple_HFS Taiko 111.5 Gi disk0s2

3: Apple_Boot Boot OSX 128.0 Mi disk0s3

/dev/disk1

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *298.1 Gi disk1

1: EFI 200.0 Mi disk1s1

2: Apple_HFS some-unreadable-characters-here

297.8 Gi disk1s2

3: Apple_Boot Boot OSX 128.0 Mi disk1s3

/dev/disk2

#: TYPE NAME SIZE IDENTIFIER

0: CD_partition_scheme *234.7 Mi disk2

1: CD_ROM_Mode_1 SLAX 204.4 Mi disk2s0

/dev/disk3

#: TYPE NAME SIZE IDENTIFIER

0: Apple_partition_scheme *222.9 Gi disk3

1: Apple_partition_map 31.5 Ki disk3s1

2: Apple_HFS go 222.9 Gi disk3s2

Musashi:~ go$ hexdump -C -n 128 /dev/rdisk1

00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|

3) I then ran the following commands you provided in a previous post:

Musashi:~ go$ pgpwde --disk 1 --recover --passphrase

Searching disk for PGP WDE signature

112304128 sectors searched, 512838320 sectors to go

Found Primary BGFS record on sector 112304544

Recovery successful!

No bootable volumes found. Checks complete.

Musashi:~ go$ sync

Musashi:~ go$ hexdump -C -n 128 /dev/rdisk1

00000000 eb 48 90 50 47 50 47 55 41 52 44 00 00 00 00 00 |?H.PGPGUARD.....|

00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|

*

00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 02 |................|

00000040 ff 00 a0 a1 b1 06 00 00 00 00 fa ea 50 7c 00 00 |?.???.....??P|..|

00000050 31 c0 8e d8 8e d0 bc 00 20 fb a0 40 7c 3c ff 74 |1?.?.м. ??@|

00000060 02 88 c2 52 be 6c 7d e8 2f 01 f6 c2 80 74 48 b4 |..?R?l}?/.??.tH?|

00000070 41 bb aa 55 cd 13 5a 52 72 3d 81 fb 55 aa 75 37 |A??U?.ZRr=.?U?u7|

00000080

Musashi:~ go$ hexdump -C -n 128 /dev/disk1

00000000 eb 48 90 50 47 50 47 55 41 52 44 00 00 00 00 00 |?H.PGPGUARD.....|

00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|

*

00000030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 02 |................|

00000040 ff 00 a0 a1 b1 06 00 00 00 00 fa ea 50 7c 00 00 |?.???.....??P|..|

00000050 31 c0 8e d8 8e d0 bc 00 20 fb a0 40 7c 3c ff 74 |1?.?.м. ??@|

00000060 02 88 c2 52 be 6c 7d e8 2f 01 f6 c2 80 74 48 b4 |..?R?l}?/.??.tH?|

00000070 41 bb aa 55 cd 13 5a 52 72 3d 81 fb 55 aa 75 37 |A??U?.ZRr=.?U?u7|

00000080

Musashi:~ go$ pgpwde --disk 1 --auth-disk --passphrase


4) If the --auth-disk command worked, the suggestion was to then use unmountdisk disk1 and then try and mount the disk using mountdisk disk1


5) The trouble was that, for whatever reason, each time the "unmountdisk" command was used - it worked - BUT it also erased / removed the PGPGUARD information located by the --recover command and synced using "sync".


6) Instead, after the successful --auth-disk command above, I started DISK WARRIOR (which was installed on the laptop where I was running the pgpwde commands) and it found the disk (previously it had been able to find the disk but could NOT optimize and rebuild the directory as it was unable to access a non-authenticated disk).


7) After running DISK WARRIOR it created a replacement directory which could NOT be compared to the original as the original was too severely damaged. I previewed the new directory and decided to use it to replace the damaged one.


8) After installing the new directory - voila - disk1 and all its volumes would mount and unmount (I had fun playing with this several times). As you can see below - disk1s2 no longer had a garbled name but showed "Macintosh HD" instead (which was the disk name).


Musashi:~ go$ diskutil list

/dev/disk0

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *111.8 Gi disk0

1: EFI 200.0 Mi disk0s1

2: Apple_HFS Taiko 111.5 Gi disk0s2

3: Apple_Boot Boot OSX 128.0 Mi disk0s3

/dev/disk1

#: TYPE NAME SIZE IDENTIFIER

0: GUID_partition_scheme *298.1 Gi disk1

1: EFI 200.0 Mi disk1s1

2: Apple_HFS Macintosh HD 297.8 Gi disk1s2

3: Apple_Boot Boot OSX 128.0 Mi disk1s3

/dev/disk2

#: TYPE NAME SIZE IDENTIFIER

0: CD_partition_scheme *234.7 Mi disk2

1: CD_ROM_ 204.4 Mi disk2s0

/dev/disk3

#: TYPE NAME SIZE IDENTIFIER

0: Apple_partition_scheme *222.9 Gi disk3

1: Apple_partition_map 31.5 Ki disk3s1

2: Apple_HFS go 222.9 Gi disk3s2

Musashi:~ go$ diskutil mountdisk disk1

Volume(s) mounted successfully

Musashi:~ go$ diskutil unmountdisk disk1

Unmount of all volumes on disk1 was successful

Musashi:~ go$ diskutil mountdisk disk1

Volume(s) mounted successfully

Musashi:~ go$ diskutil unmountdisk disk1

Unmount of all volumes on disk1 was successful


9) I then shut everything down, and tried to boot the laptop - no go - still got the spinning wheel then the "no go" icon.


10) I reconnected everything, put the laptop in Target mode again - and it popped up on the desktop and requested my PGP Passphrase. (A good sign). I entered the passphrase and disk1 mounted on the desktop (wow- two good signs).


11) After that I entered another Terminal session and - after checking to ensure the disk status showed disk1 as being instrumented by Bootguard, I started the --decrypt command. It took about 16 hours to decrypt.


12) I unmounted the disk, unplugged the firewire cable and tried to boot the laptop. Success! I chose to use Disk Warrior again to clean up the multitude of permission errors. I still have problems updating some minor programs but the data is all there.

I wrote all this out so others would know what I did. I can't thank you enough for all your efforts as it was your research that lead to the recovery of the disk. Many thanks for the great support from PGP!


AimPoint


=====END======


No comments:

Post a Comment