Safeboot recovery instructions for helpdesk engineers

Safeboot has been corrupted-92h error

IMPORTANT: Ensure that your computer's main power supply is plugged in before continuing with this procedure. Do not attempt to perform on battery only.

PrerequisitesBefore proceeding you must have the following:

• The BartPE Boot CD/DVD.
• The floppy drive or USB containing the computer's configuration file (.SDB). This contains the computer's key that provides access to the problem computer.
  NOTE: Any USB sticks and drives required to access the computer must be plugged in before WinTech starts.
• The daily access/authorization code. You can get this directly from McAfee Support, or from your internal Helpdesk:
• To obtain the Endpoint Encryption (formerly SafeBoot) Code of the Day from the McAfee ServicePortal, see KB61073.
• Availability from your Helpdesk is dependent on your contract with McAfee.

 Data Recovery Procedure

This procedure uses the Authenticate to SafeBoot Files System (SBFS) method.

1. Start the computer with the BartPE CD/DVD (WinTech CD). This loads the Endpoint Encryption interface.
2. Click Go, Programs, EEPC WinTech or Safeboot WinTech
3. When prompted, type the access code, and then click OK.
4. From the main menu, click WinTech and select Authenticate from SBFS.
5. Type the Safeboot username and password, and then click OK. 
6. Click Go,Programs,A43 File Management Utility
7. Click on C: and copy all the data to your external drive.

McAfee Download Site

To download McAfee products, updates, and documentation, visit the Downloads page at http://www.mcafee.com/us/downloads/downloads.aspx.

For instructions on downloading, see: KB56057.

And also see bellow details from MacAfee

How to use the WinTech CD to remove the encryption and boot sector from the hard disk

Environment

McAfee Endpoint Encryption for PC 5.x.x
McAfee WinTech CD

For details of all supported operating systems, see KB51109.


NOTE: Endpoint Encryption for PC was formerly known as SafeBoot Device Encryption. McAfee Endpoint Encryption for PC 5.1.7 (Build 5500) was the first release to be branded with the new McAfee product name.

Summary

This article provides two solutions to overcome the following types of situations:

• Windows becomes corrupt.
• You cannot access the data of an encrypted computer.
• Encryption or decryption fails.

IMPORTANT: Only attempt the following procedures if you are a trained Helpdesk operator within your company, or call McAfee Technical Support.

Solution 1

IMPORTANT: Ensure that your computer's main power supply is plugged in before continuing with this procedure. Do not attempt to perform on battery only.

Prerequisitesbefore proceeding you must have the following:

• The BartPE Boot CD/DVD.
• The floppy drive or USB containing the computer's configuration file (.SDB). This contains the computer's key that provides access to the problem computer.
  NOTE: Any USB sticks and drives required to access the computer must be plugged in before WinTech starts.
• The daily access/authorization code. You can get this directly from McAfee Support, or from your internal Helpdesk:
• To obtain the Endpoint Encryption (formerly SafeBoot) Code of the Day from the McAfee ServicePortal, see KB61073.
• Availability from your Helpdesk is dependent on your contract with McAfee.

Recovery Procedure 1This procedure uses the Authenticate to SafeBoot Files System (SBFS) method.

1. Start the computer with the BartPE CD/DVD (WinTech CD). This loads the Endpoint Encryption interface.
2. Click Go, Programs, EEPC WinTech.
3. When prompted, type the access code, and then click OK.
4. From the main menu, click EEPC and select Authenticate from SBFS.
5. Type the computer username and password, and then click OK. 
6. From the main menu click EEPC and select Remove EEPC. This decrypts the drive and removes the boot sector.
   NOTE: It might take a few hours, depending on the computer's performance and the storage capacity of the drive or partition. 
7. When Endpoint Encryption has been removed, delete its record from the Endpoint Encryption Manager. (The central record will no longer have the correct parameters for this computer).
   See the Endpoint Encryption for PC Administration Guide for further information or contact your Endpoint Encryption Database Administrator.

CAUTION: The next time Windows is started, Endpoint Encryption automatically reactivates itself if the installed files are still intact. It also connects to the Endpoint Encryption Server. The computer might also encrypt at this point, depending on its database settings.
Required action to prevent this from happening:

1. Disconnect from the network prior to starting the computer (or disable wireless networking).
   NOTE: Disconnecting from the network will prevent reactivation only if this computer was originally an Online install. If it was an Offline install, then start with Windows Safe Mode first. See the Endpoint Encryption for PC Administration Guide for further information regarding online and offline installation.
2. Allow Windows to load.
3. Click Start, Run, type cmd, then click OK.
4. Change to the Endpoint Encryption folder on the client using DOS commands. Default location is: c:\Program Files\McAfee\Endpoint Encryption for PC. Type:
   
   CD "c:\Program Files\McAfee\Endpoint Encryption for PC"
5. Type sbsetup –uninstall
6. 
   NOTE: The drive must be completely unencrypted for this command to work.

Solution 2

If Endpoint Encryption does not work and the Encryption and Boot Sector removal procedure in Solution 1 cannot be used, then follow this alternative procedure.

Prerequisites
Before proceeding you must have the following:

• The BartPE Boot CD/DVD boot CD.
• The floppy drive or USB containing the computers configuration file (.SDB) that has been exported from the Endpoint Encryption database. This contains the machine key that will provide access to the problem computer.
  
  NOTE: Any USB sticks and drives required to access the computer must be plugged in before WinTech starts.
   
• The daily access/authorization code. This can be obtained either directly from McAfee Support or from your internal Help Desk.
  To obtain the Endpoint Encryption (formerly SafeBoot) Code of the Day from the McAfee ServicePortal, see KB61073.
  
  NOTE: Availability from your Helpdesk is dependent on your contract with McAfee.
   

Recovery Procedure 2This procedure uses the authentication method: Authenticate to Database

1. Create a SafeTech Boot Disk.
   First create a SafeTech recovery disk at the McAfee Endpoint Encryption Manager and export the User/Computer configuration to the floppy disk/USB device.

This procedure is documented in:

·         The WinTech and SafeTech Administration Guide. These guides are available from either:

·         How to create a SafeTech boot disk for Endpoint Encryption, see KB53257.

The WinTech and SafeTech Administration Guide is available at:

McAfee ServicePortalFor a full list of product documents, go to the McAfee ServicePortal (http://mysupport.mcafee.com/Eservice/Default.aspx), and click Product Documentation.


McAfee Download Site

To download McAfee products, updates, and documentation, visit the Downloads page at http://www.mcafee.com/us/downloads/downloads.aspx.

For instructions on downloading, see: KB56057.
 

2. Use the WinTech CD and SafeTech Recovery disk.
1. Start your computer with the BartPE CD/DVD. This loads the Endpoint Encryption interface.
2. Click Go, Programs, EEPC WinTech.
3. When prompted, type in the access code, then clicks OK.
4. From the main menu click EEPC, then select Authenticate from Database.
5. Select the computer's SDB file, then click OK.
6. From Select Machine, select the correct computer name. 
7. From the main menu click Workspace and select Open Workspace.
8. From the menu Workspace select Load From Sectors.
9. In the Load sector window enter the start sector to use for decryption in the workspace (memory), this  can verify if the key is correct. Usually sector 63 after decryption would show readable content.
10. In the sector count section, type in the number of sectors that need to be read after the start sector. This is usually 1.
11. Select from the Workspace menu the option Decrypt Workspace to decrypt the read sectors in the memory.
    NOTE: If there is readable data showing the key loaded is correct, then you can proceed to the next step; otherwise the read SDB file may contain the incorrect key and decrypting/removing the encryption may damage the data on the hard disk.
12. From the main menu, click EEPC, and then select Remove EEPC. This decrypts the drive and removes the boot sector.
    NOTE: It might take some hours depending on the computer performance and the storage capacity of the drive or partition.
13. When Endpoint Encryption has been removed, delete its record from the Endpoint Encryption Manager. (The central record will no longer have the correct parameters for this computer.)
    See the Endpoint Encryption for PC Administration Guide for further information, or, contact your Endpoint Encryption Database Administrator.

NOTE:  If you had a problem with Windows and the operating system is repaired, Endpoint Encryption will automatically reactivate itself if the installed files are still intact. It also connects to the Endpoint Encryption Server. The computer might also encrypt at this point, depending on its settings in the database.

Required action to prevent this from happening:

a.       Disconnect from the network prior to starting your computer (or disable wireless networking).

b.      Allow Windows to load.

c.       Click Start, Run, type cmd, then click OK.

d.      Change to the Endpoint Encryption folder on the client using DOS commands (default location is: c:\Program Files\McAfee\Endpoint Encryption for PC). Type:

CD "c:\Program Files\McAfee\Endpoint Encryption for PC"

e.       Type sbsetup –uninstall
NOTE: The drive must be completely unencrypted for this command to work.

WARNING: Disconnecting from the network will prevent reactivation only if this computer was originally an online install of Endpoint Encryption for PC. If it was an offline install start with Windows Safe Mode first.  See the Endpoint Encryption for PC Administration Guide PDF document for further information regarding online and offline installation.

Mcafee Official website