How to recover encrypted files after a system crash with Symantec Endpoint Encryption

Products

• Endpoint Encryption

Issue/Introduction

The user has encrypted several whole directories and had a major system crash. After reinstalling the operating system, the user was able to copy the encrypted files from the damaged hard disk, but could not decrypt them, then tried copying the old version of Encryption Plus (EP) Folders (F) and using the same password but nothing works.

Resolution

To solve this issue, follow the steps below:

1. Use the Recover Program that was created when EP Folders was installed. The "EPFolder.dat" file that was created during the original encryption of the folder must be present in order for this process to be completed successfully.
2. If the Recover Program does not work, there is another procedure that may restore the files, which requires that the EPF be rebuilt.
   1. Make sure that the encrypted folder is in the same location on the new drive as on the old (c:\my_folder on the old should be c:\my_folder on the new).
   2. The folder should contain all contents including the file "epfolder.dat."
   3. The files epfpfd10.mdb and epluscom.mdb will need to be salvaged from the old drive or from a backup.
   4. Run setup to install EP Folders, but select NO when prompted to reboot.
   5. Copy the original "epfpfd10.mdb" to "c:\program files\epfolders."
   6. Copy the original "epluscom.mdb" to "c:\program files\common files\eplusfolders."
   7. Restart the computer. The old password should now authenticate and provide access to the files in the protected folder.

Important Note: Re-installing the EPF program and using the same user name and password would not decrypt the files. The above steps included re-installing EPF using the original ".mdb" files otherwise a new unique public/private keys would have been generated as part of the installation. A new unique key would not have matched the previously encrypted folder.