Mcafee Eetech 2841b
This document was ed by and they confirmed that they have the permission to share it. If you are author or own the copyright of this book, please report to us by using this report form. Report 2z6p3t
Overview 5o1f4z
& View Mcafee Eetech as PDF for free.
More details 6z3438
- Words: 9,587
- Pages: 32
McAfee EETech Guide
COPYRIGHT Copyright © 2010 McAfee, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of McAfee, Inc., or its suppliers or companies. TRADEMARK ATTRIBUTIONS AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE EXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN, WEBSHIELD are ed trademarks or trademarks of McAfee, Inc. and/or its s in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other ed and uned trademarks herein are the sole property of their respective owners. LICENSE INFORMATION License Agreement NOTICE TO ALL S: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU ED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.
2
McAfee EETech Guide
Contents Introducing McAfee EETech. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Audience. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Using this guide. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
EETech (WinPE V1). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Creating EETech WinPE V1 Recovery CD/DVD using BartPE. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Booting from EETech WinPE V1 Recovery CD/DVD. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Authorizing with daily authorization code. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Authenticating with token. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Exporting the recovery information file from ePO. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Authenticating with recovery file. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Performing self recovery with token authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Removing encryption and boot sector with token authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Removing encryption and boot sector with file authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Viewing the workspace. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Encrypting or Decrypting sectors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Restoring the MBR (Master Boot Record). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
EETech (Standalone). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Creating EETech (Standalone) boot disk. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Booting from the EETech (Standalone) boot disk. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Authorizing with daily authorization code. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Authenticating with token. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Exporting the recovery information file from ePO. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Authenticating with recovery file. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Performing self recovery with token authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Performing emergency boot. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Removing encryption and boot sector with token authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Removing encryption and boot sector with file authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Viewing the workspace. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Encrypting or Decrypting sectors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Restoring the MBR (Master Boot Record). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
McAfee EETech Guide
3
Contents
Glossary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4
McAfee EETech Guide
Introducing McAfee EETech With data breaches on the rise, it is important to protect information assets and comply with privacy regulations. McAfee Endpoint Encryption for PC delivers powerful encryption that protects data from unauthorized access, loss, and exposure. EETech (WinPE Version 1) and EETech (Standalone) are McAfee’s disaster recovery systems used in conjunction with Endpoint Encryption for PC (EEPC). EETech (Standalone) is a disaster recovery tool that allows the to perform normal recovery functions. EETech (WinPE V1) performs the same functions under a Windows-like environment and includes greater features such as booting from BartPE and easier access to USB drives. Audience Using this guide
Audience This guide is mainly intended for qualified system s and security managers. Knowledge of basic networking and routing concepts, and a general understanding of the aims of centrally managed security is required.
Using this guide This guide helps corporate security s to understand the disaster recovery tools, EETech (Standalone) and EETech (WinPE). This document includes procedures to recover data from systems that are unrecoverable.
McAfee EETech Guide
5
EETech (WinPE V1) EETech (WinPE V1) is a disaster recovery tool that allows the to perform recovery functions. EETech (WinPE V1) performs these functions under a Windows-like environment and includes greater features such as booting from BartPE and easier access to USB drives. CAUTION: It is entirely the responsibility of the qualified system s and security managers to take appropriate precautions while using EETech (WinPE V1) recovery tool. The needs to handle the EETech Recovery tool with maximum care, otherwise, it may cause the system to become corrupt and that might result in the loss of data. Contents Creating EETech WinPE V1 Recovery CD/DVD using BartPE Booting from EETech WinPE V1 Recovery CD/DVD Authorizing with daily authorization code Authenticating with token Exporting the recovery information file from ePO Authenticating with recovery file Performing self recovery with token authentication Removing encryption and boot sector with token authentication Removing encryption and boot sector with file authentication Viewing the workspace Encrypting or Decrypting sectors Restoring the MBR (Master Boot Record)
Creating EETech WinPE V1 Recovery CD/DVD using BartPE Bart's PE Builder helps you build a "BartPE" (Bart Preinstalled Environment) bootable Windows CD/DVD from the original Windows XP Operating System. Before you create the BartPE CD/DVD, you need to have the Windows XP \i386 folder. The i386 folder holds the files used to install, repair, modify, update, and rebuild Windows. This can be found on the root directory of a Windows XP Pro/Home installation CD. Task 1
the latest BartPe install file. NOTE: Refer to http://www.nu2.nu/pebuilder/ website for the required information and links.
6
McAfee EETech Guide
EETech (WinPE V1) Creating EETech WinPE V1 Recovery CD/DVD using BartPE
2
Install BartPe to the default install locations of your local system.
3
Open Microsoft Windows Explorer and navigate to the \pebuilderxxxxx\plugin folder. NOTE: xxxxx denotes the version number of BartPE.
4
Extract EETech.zip to the desired location. Copy WinPE folder from EETech folder to the \pebuilderxxxxx\plugin folder.
5
Create a subfolder EEPC inside the \pebuilderxxxxx folder. This acts as a source folder for the Endpoint Encryption recovery files.
6
Copy the i386 folder to the root drive C:\
7
Launch BartPe. The BartPE CD/DVD Builder page appears.
Figure 1: The BartPE CD/DVD Builder window 8
Type or browse to the path for the Windows installation files in the Source field.
9
Type or browse to the path to include other files and folders from this directory in the Custom field.
10 Type a directory name in the Output field to store the files that PE Builder copies. Ensure that the location you type is relative to your \pebuilder directory. NOTE: If you need to specify an absolute path, you must change the Output path absolute in the Builder | Options dialog. 11 Use the Media output pane to specify whether you want to create a CD/DVD or an ISO image. NOTE: You can click the Plugins button to add, edit, enable/disable, configure or remove plugins from the list.
McAfee EETech Guide
7
EETech (WinPE V1) Booting from EETech WinPE V1 Recovery CD/DVD
12 Click Build to start writing the CD/DVD or build the ISO image.
Booting from EETech WinPE V1 Recovery CD/DVD EETech (WinPE) is accessed through the BartPE plug-in boot CD/DVD. When the boots the unrecoverable system with the BartPE Windows CD/DVD, the first page that appears is the Endpoint Encryption interface. This is followed by a dialogue that prompts the to start network services. You can start the network services if you have added the drivers for your Ethernet card to the CD/DVD build, otherwise click No. Task 1
Boot the unrecoverable system with the EETech WinPE V1 Recovery CD/DVD. The Endpoint Encryption interface appears.
2
Click Go | Programs | McAfee EETech. The McAfee EETech page appears.
Figure 2: McAfee EETech (WinPE) interface
Authorizing with daily authorization code Use this task to authorize the recovery tasks using the daily authorization code. Before you begin Ensure that the system’s main power supply is plugged in for this task. Do not attempt to perform this task on battery only. Before proceeding with this task, you must have the following: • The EETech WinPE V1 Recovery CD/DVD boot disk.
8
McAfee EETech Guide
EETech (WinPE V1) Authenticating with token
• The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . Task 1
Boot the system with the EETech WinPE V1 Recovery CD/DVD. This loads the Endpoint Encryption interface.
2
Click Go | Programs | McAfee EETech. The McAfee EETech page appears.
3
Click Authorize under Authorization. The Authorize dialogue appears.
4
Type the daily Authorization/Access Code and click OK. On typing the correct authorization code for the day, the Authorization status changes to Authorized.
Authenticating with token Use this task to authenticate the recovery tasks using the Endpoint Encryption credentials for the system. Before you begin Before proceeding with this task, ensure that you have the EETech WinPE V1 Recovery CD/DVD boot disk Task 1
Ensure that the system’s main power supply is plugged in for this task. Do not attempt to perform this task on battery only.
2
Boot the system with the EETech WinPE V1 Recovery CD/DVD. This loads the Endpoint Encryption interface.
3
Click Go | Programs | McAfee EETech. The McAfee EETech page appears.
McAfee EETech Guide
9
EETech (WinPE V1) Exporting the recovery information file from ePO
4
Click Token under Authentication. The Endpoint Encryption Logon page appears and prompts for the Endpoint Encryption credentials for the system.
Figure 3: Authenticate with token 5
Type the name and for the client system and click Logon. On providing the correct credential, the Authentication status changes to Authenticated with Token.
Exporting the recovery information file from ePO Use this task to export the recovery information file (.xml) for the desired system from ePO. Every system that is encrypted through ePO has a recovery information file in ePO. Any trying to authenticate the recovery procedures on the client systems should get the file from the ePO for EEPC. Before you begin You must have appropriate permissions to perform this task. Task
10
1
Insert your choice of removable media, such as floppy disk or USB drive, to the system where ePO server is present.
2
Click Menu | Systems | System Tree in ePO server. The Systems page appears. Select the desired group under System Tree pane on the left.
3
Select the desired System, then click Actions | Endpoint Encryption | Export Recovery Information. The Export Recovery Information confirmation page appears.
4
Click Yes to export the recovery information file. The Export Recovery Information page appears with the Export information (.xml) file.
McAfee EETech Guide
EETech (WinPE V1) Authenticating with recovery file
5
Right-click the .xml file and save it to the inserted removable media, such as floppy disk or USB drive. NOTE: The Recovery Information File has a general format of client system name.xml.
Authenticating with recovery file Use this task to authenticate the recovery procedures using the Recovery Information File (.xml). The needs to export the Recovery Information File for the desired system from ePO server. Before you begin Before proceeding with this task, you must have the following: • The EETech WinPE V1 Recovery CD/DVD boot disk. • The floppy drive or USB containing the Recovery Information File (.xml). • The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . Task 1
Ensure that the system’s main power supply is plugged in for this task. Do not attempt to perform this task on battery only.
2
Boot the system with the EETech WinPE V1 Recovery CD/DVD. This loads the Endpoint Encryption interface.
3
Click Go | Programs | McAfee EETech. The McAfee EETech page appears.
McAfee EETech Guide
11
EETech (WinPE V1) Performing self recovery with token authentication
4
Click File under Authentication, then browse and select the Recovery Information File (.xml) from the floppy disk or USB drive, then click OK. On selecting the right file, the Authentication status changes to Authenticated with File. NOTE: After the authorization and authentication, the McAfee EETech interface appears as shown in this figure.
Figure 4: McAfee EETech (WinPE) interface after authorization and authentication
Performing self recovery with token authentication Use this option in the client computer, if the 's or the logon token have been lost, to recover the . Before you begin The must have successfully enrolled for self recovery on the client system to perform this task. This task should be performed by the client on the client computer. Before proceeding with this task, you must have the following: • The EETech WinPE V1 Recovery CD/DVD boot disk. Task
12
1
Ensure that the system’s main power supply is plugged in for this task. Do not attempt to perform this task on battery only.
2
Boot the system with the EETech WinPE V1 Recovery CD/DVD. This loads the Endpoint Encryption interface.
3
Click Go | Programs | McAfee EETech. The McAfee EETech page appears.
4
Click Token under Authentication. The Endpoint Encryption Logon page appears and prompts for the Endpoint Encryption credentials for the .
McAfee EETech Guide
EETech (WinPE V1) Removing encryption and boot sector with token authentication
5
Click Options | Recovery. The Recovery dialog box appears with option Self-Recovery selected by default.
Figure 5: Self Recovery with token authentication 6
Type the name and click OK. The Recovery dialog box appears with the questions that the answered while enrolling for the self recovery.
7
Type the answers for the prompted questions and click Finish. The Change dialog box appears.
8
Type and confirm the New and click OK. The Logon page appears and prompts for the Endpoint Encryption credentials for the . The can now type the newly set and to the system.
Removing encryption and boot sector with token authentication Use this task in the following situations when: • Windows becomes corrupt. • You cannot access the data of an encrypted system. • Encryption or decryption fails. Before you begin Before proceeding with this task, you must have the following: • The EETech WinPE V1 Recovery CD/DVD boot disk.
McAfee EETech Guide
13
EETech (WinPE V1) Removing encryption and boot sector with token authentication
• The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . Task 1
Ensure that the system’s main power supply is plugged in for this task. Do not attempt to perform this task on battery only.
2
Boot the system with the EETech WinPE V1 Recovery CD/DVD. This loads the Endpoint Encryption interface.
3
Click Go | Programs | McAfee EETech. The McAfee EETech page appears.
4
Authorize with daily Authorization code and confirm the authorization status.
5
Authenticate with Token and confirm the authentication status.
6
Click Remove EE under Actions. The Remove EE page appears.
Figure 6: Remove Encryption 7
14
Click Remove to begin the removal. This removes encryption and boot sector from the client system, however, this does not remove Endpoint Encryption client files. It might take a few hours depending on the system performance and the storage capacity of the drive or partition.
McAfee EETech Guide
EETech (WinPE V1) Removing encryption and boot sector with file authentication
Removing encryption and boot sector with file authentication If Endpoint Encryption does not work and the previous Encryption and Boot Sector Removal with token authentication cannot be used, then follow this task. CAUTION: This procedure should only be attempted under the guidance of McAfee . For this method, the recovery information file (.xml) should be exported from ePO. Before you begin Before proceeding with this task, you must have the following: • The EETech WinPE V1 Recovery CD/DVD boot disk. • The floppy drive or USB containing the Recovery Information File (.xml). • The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . Task 1
Insert the removable media that has the Recovery Information File (.xml) exported from ePO server.
2
Boot the system with the EETech WinPE V1 Recovery CD/DVD. This loads the Endpoint Encryption interface.
3
Click Go | Programs | McAfee EETech. The McAfee EETech page appears.
4
Authorize with daily Authorization code and confirm the authorization status.
5
Authenticate with Recovery Information File (.xml) and confirm the authentication status.
6
Click Remove EE under Actions. The Remove EE page appears.
7
Click Remove to begin the removal. This removes encryption and boot sector from the client system, however, this does not remove Endpoint Encryption client files. It might take a few hours depending on the system performance and the storage capacity of the drive or partition. NOTE: Remove the client system from ePO server after removing Endpoint Encryption from the client system.
Viewing the workspace The workspace contains the bytes loaded from the sectors on the disk or from a file. This option opens the Workspace window which allows the s to read sector ranges from the disk and to view the contents. By default, there is nothing loaded into the workspace. The workspace is not a view of the disk, rather it is only a view of what the loads into it. The can choose to load the contents
McAfee EETech Guide
15
EETech (WinPE V1) Encrypting or Decrypting sectors
of sectors or the contents of a file. Once the loads any of these, it is displayed in the workspace. CAUTION: It is entirely the responsibility of the qualified system s and security managers to take appropriate precautions before performing this task. The needs to take maximum care while performing this task, otherwise, it may cause the system to become corrupt and that might result in the loss of data. McAfee for assistance on how to use the EETech Workspace. Before you begin Before proceeding with this task, you must have the following: • The EETech WinPE V1 Recovery CD/DVD boot disk. • The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . • Recovery Information File (.xml) or Authentication Token Task 1
Boot the system with the EETech WinPE V1 Recovery CD/DVD. This loads the Endpoint Encryption interface.
2
Click Go | Programs | McAfee EETech. The McAfee EETech page appears.
3
Authorize with daily Authorization code and confirm the authorization status.
4
Authenticate with Token or Recovery Information File (.xml) and confirm the authentication status.
5
Click Workspace under Actions. The Workspace page appears with following options: • Load From File -It just loads the bytes from the file and displays them. • Save To File - This option saves the current values of the bytes to the file. • Load From Disk - This loads the bytes from the sectors on the disk. • Save To Disk - This option saves the current values of the bytes to the disk. • Zero Workspace - This option files the workspace with zeros. • Encrypt Workspace - This option encrypts the entire contents of the workspace. • Decrypt Workspace - This option decrypts the entire contents of the workspace. • Set workspace Alg - Use this option to select and set the desired workspace algorithm.
6
Click First Sector to view the first sector of the workspace.
7
Click Previous Sector to view the previous sector of the current sector of the workspace.
8
Click Next Sector to view the next sector of the current sector of the workspace.
9
Click Last Sector to view the last sector of the workspace.
Encrypting or Decrypting sectors This option allows you to safely manipulate which sectors are encrypted on the disk. This option follows the crypt list to validate the ranges you submit, so that it does not encrypt sectors which
16
McAfee EETech Guide
EETech (WinPE V1) Restoring the MBR (Master Boot Record)
are currently encrypted, and does not decrypt sectors which are currently not encrypted. This option s power fail protection. Crypt Sector option cannot be used if Endpoint Encryption has become corrupt on the disk, or the crypt state has been corrupted, however, the Force Crypt Sectors option can be used in such cases. While changing the encryption state with this option, it effects with appropriate modifications to the disk Crypt List. For example, while you encrypt a new range, it creates a new Region definition. While you decrypt within an existing Region, the existing region is split into two, if you completely decrypt a region, it removes the Region from the crypt list. CAUTION: It is entirely the responsibility of the qualified system s and security managers to take appropriate precautions before performing this task. The needs to take maximum care while performing this task, otherwise, it may cause the system to become corrupt and that might result in the loss of data. Before you begin Before proceeding with this task, you must have the following: • The EETech WinPE V1 Recovery CD/DVD boot disk. • The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . • Recovery Information File (.xml) or Authentication Token Task 1
Boot the system with the EETech WinPE V1 Recovery CD/DVD. This loads the Endpoint Encryption interface.
2
Click Go | Programs | McAfee EETech. The McAfee EETech page appears.
3
Authorize with daily Authorization code and confirm the authorization status.
4
Authenticate with Token or Recovery Information File (.xml) and confirm the authentication status.
5
Click Set Boot Disk and select the relevant boot disk from the Set Boot Disk page.
6
Click Set Algorithm and select the desired algorithm from the Select Algorithm page.
7
Click Crypt Sectors and select the disk from the Select Disk list, then type the Start Sector and the Number of Sectors.
8
Click Encrypt/Decrypt to encrypt/decrypt a range of sectors.
Restoring the MBR (Master Boot Record) The MBR is the first sector of the boot disk. It is that part of the hard drive which tells the operating system what to boot and from where to boot. The MBR loads the boot sector which in turn will load the operating system. The MBR of a EEPC installed system is stored in ePO during the EEPC deployment and can therefore be exported as part of the Recovery Information file (.xml). NOTE: If you have performed a manual (forced) decrypt, then you must follow this procedure to restore the original MBR.
McAfee EETech Guide
17
EETech (WinPE V1) Restoring the MBR (Master Boot Record)
Before you begin Before proceeding with this task, you must have the following: • The EETech WinPE V1 Recovery CD/DVD boot disk. • The floppy drive or USB containing the recovery information file (.xml) and this must be plugged in before booting from The BartPE Boot CD/DVD boot CD/DVD. Task 1
Boot the system with the EETech WinPE V1 Recovery CD/DVD. This loads the Endpoint Encryption interface.
2
Click Go | Programs | McAfee EETech. The McAfee EETech page appears.
3
Authorize with daily Authorization code and confirm the authorization status.
4
Authenticate with Token or Recovery Information File (.xml) and confirm the authentication status.
5
Click Restore MBR under Disk Operations. The confirmation page appears.
6
Click Yes to confirm that you want to overwrite the Master Boot Record. NOTE: While you authenticate through file or token and use this option, it replaces the code portion of the MBR with the one that was present prior to installing Endpoint Encryption. CAUTION: Restoring MBR should be performed on a system where the boot disk is not encrypted, else an error message Missing Operating System is displayed.
18
McAfee EETech Guide
EETech (Standalone) This chapter explains some of the common tasks that can be undertaken using McAfee’s disaster recovery tool, the standalone version of the EETech. Ensure that you exercise caution for all EETech procedures. Contents Creating EETech (Standalone) boot disk Booting from the EETech (Standalone) boot disk Authorizing with daily authorization code Authenticating with token Exporting the recovery information file from ePO Authenticating with recovery file Performing self recovery with token authentication Performing emergency boot Removing encryption and boot sector with token authentication Removing encryption and boot sector with file authentication Viewing the workspace Encrypting or Decrypting sectors Restoring the MBR (Master Boot Record)
Creating EETech (Standalone) boot disk McAfee EETech (Standalone) enhances the experience with a simplified process of creating the EETech boot disk. You can create the boot disk just by running a simple command from the command prompt. Before you begin Before proceeding with this task, you must have the following: • A: drive in your computer • A floppy disk Task 1
Extract EETech.zip and place the Standalone folder in the desired location.
2
Insert the floppy disk.
3
Point to the Standalone folder from the command prompt.
McAfee EETech Guide
19
EETech (Standalone) Booting from the EETech (Standalone) boot disk
4
Run the command Bootdisk.exe EETech.RTB a: from the command prompt. This creates the bootable floppy.
5
Create a boot disk CD/DVD using this bootable floppy.
Booting from the EETech (Standalone) boot disk EETech (Standalone) is accessed through the EETech Standalone boot CD/DVD. When the boots the unrecoverable system with the EETech Standalone boot disk, the first page that appears is the McAfee EETech interface. Task 1
Boot the unrecoverable system with the EETech (Standalone) boot CD/DVD. The McAfee EETech interface appears.
Figure 7: McAfee EETech (Standalone) interface
Authorizing with daily authorization code Use this task to authorize the recovery tasks using the daily authorization code. Before you begin Before proceeding with this task, you must have the following: • The EETech (Standalone) boot disk. • The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee .
20
McAfee EETech Guide
EETech (Standalone) Authenticating with token
Task 1
Ensure that the system’s main power supply is plugged in for this task. Do not attempt to perform this task on battery only.
2
Restart the unrecoverable system using the EETech (Standalone) boot disk. This loads the McAfee EETech interface.
3
Click Authorize under Authorization. The Authorize dialogue appears.
4
Type the daily Authorization/Access Code and click OK. On typing the correct authorization code for the day, the Authorization status changes to Authorized.
Authenticating with token Use this task to authenticate the recovery tasks using the Endpoint Encryption credentials for the system. Before you begin Before proceeding with this task, you must have the following: • The EETech (Standalone) boot disk. • The floppy drive or USB containing the Recovery Information File (.xml). Task 1
Ensure that the system’s main power supply is plugged in for this task. Do not attempt to perform this task on battery only.
2
Restart the unrecoverable system using the EETech (Standalone) boot disk. This loads the McAfee EETech interface.
3
Click Token under Authentication. The Endpoint Encryption Logon page appears and prompts for the Endpoint Encryption credentials for the system.
4
Type the name and for the client system and click Logon. On typing the correct credential, the Authentication status changes to Authenticated with Token.
Exporting the recovery information file from ePO Use this task to export the recovery information file (.xml) for the desired system from ePO. Every system that is encrypted through ePO has a recovery information file in ePO. Any trying to authenticate the recovery procedures on the client systems should get the file from the ePO for EEPC. Before you begin You must have appropriate permissions to perform this task. Task 1
Insert your choice of removable media, such as floppy disk or USB drive, to the system where ePO server is present.
2
Click Menu | Systems | System Tree in ePO server. The Systems page appears. Select the desired group under System Tree pane on the left.
McAfee EETech Guide
21
EETech (Standalone) Authenticating with recovery file
3
Select the desired System, then click Actions | Endpoint Encryption | Export Recovery Information. The Export Recovery Information confirmation page appears.
4
Click Yes to export the recovery information file. The Export Recovery Information page appears with the Export information (.xml) file.
5
Right-click the .xml file and save it to the inserted removable media, such as floppy disk or USB drive. NOTE: The Recovery Information File has a general format of client system name.xml.
Authenticating with recovery file Use this task to authenticate the recovery tasks using the Recovery Information File (.xml). The needs to export the Recovery Information File for the desired system from ePO server. Before you begin Before proceeding with this task, you must have the following: • The EETech (Standalone) boot disk. • The floppy drive or USB containing the Recovery Information File (.xml). Task
22
1
Ensure that the system’s main power supply is plugged in for this task. Do not attempt to perform this task on battery only.
2
Restart the unrecoverable system using the EETech (Standalone) boot disk. This loads the McAfee EETech interface.
McAfee EETech Guide
EETech (Standalone) Performing self recovery with token authentication
3
Click File under Authentication, then browse and select the Recovery Information File (.xml) from the floppy disk or USB drive, then click OK. On selecting the right file, the Authentication status changes to Authenticated with File. NOTE: After the authorization and authentication, the McAfee EETech interface appears as shown in this figure.
Figure 8: McAfee EETech (Standalone) interface after authorization and authentication
Performing self recovery with token authentication Use this option in the client computer, if the 's or the logon token have been lost, to recover the . Before you begin The must have successfully enrolled for self recovery on the client system to perform this task. This task should be performed by the client on the client computer. Before proceeding with this task, you must have the following: • The EETech (Standalone) boot disk. Task 1
Ensure that the system’s main power supply is plugged in for this task. Do not attempt to perform this task on battery only.
2
Restart the unrecoverable system using the EETech (Standalone) boot disk. This loads the McAfee EETech interface.
3
Click Token under Authentication. The Endpoint Encryption Logon page appears and prompts for the Endpoint Encryption credentials for the .
4
Click Options | Recovery. The Recovery dialog box appears with Self-Recovery as a default option.
5
Type the name and click OK. The Recovery dialog box appears with the questions that the answered while enrolling for the self recovery.
McAfee EETech Guide
23
EETech (Standalone) Performing emergency boot
6
Type the answers for the prompted questions and click Finish. The Change dialog box appears.
7
Type and confirm the New and click OK. The Logon page appears and prompts for the Endpoint Encryption credentials for the . The can now type the newly set and to the system.
Performing emergency boot You can perform the emergency boot when an EEPC installed system fails to boot or when the Endpoint Encryption logon page is corrupt. Before you begin Before proceeding with this task, you must have the following: • The EETech (Standalone) boot disk. • The floppy drive or USB containing the Recovery Information File (.xml). • The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . Task 1
Restart the unrecoverable system using the EETech (Standalone) boot disk. This loads the McAfee EETech interface.
2
Authorize with daily Authorization code and confirm the authorization status.
3
Click Enable USB under Actions. The McAfee EETech dialogue appears with the USB enabled message.
4
Click OK to close the dialogue.
5
Click File under Authentication, then browse and select the Recovery Information File (.xml) from the floppy disk or USB drive, then click OK. On selecting the right file, the Authentication status changes to Authenticated with File.
6
Click Emergency Boot under Actions. The EETech will now emergency boot into the operating system message appears.
7
Click OK to confirm the emergency boot. NOTE: This may modify the MBR. When the system boots into Windows, if there is a network connection to the ePO server, then the system synchronizes with ePO and fully repairs itself. You can confirm this by right-clicking McAfee Agent Tray, then clicking Quick Settings | Endpoint Encryption status. NOTE: If the McAfee Agent is unable to establish connection with the ePO Server, continue to use the EETech Emergency Boot option to boot the system until a connection to the server is made.
24
McAfee EETech Guide
EETech (Standalone) Removing encryption and boot sector with token authentication
Removing encryption and boot sector with token authentication Use this task in the following situations when: • Windows becomes corrupt. • You cannot access the data of an encrypted system. • Encryption or decryption fails. Before you begin Before proceeding with this task, you must have the following: • The EETech (Standalone) boot disk. • The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . Task 1
Ensure that the system’s main power supply is plugged in for this task. Do not attempt to perform this task on battery only.
2
Restart the unrecoverable system using the EETech (Standalone) boot disk. This loads the McAfee EETech interface.
3
Authorize with daily Authorization code and confirm the authorization status.
4
Authenticate with Token and confirm the authentication status.
5
Click Remove EE under Actions. The Remove EE page appears.
Figure 9: Remove Encryption
McAfee EETech Guide
25
EETech (Standalone) Removing encryption and boot sector with file authentication
6
Click Remove to begin the removal. This removes encryption and boot sector from the client system, however, this does not remove Endpoint Encryption client files. It might take a few hours depending on the system performance and the storage capacity of the drive or partition.
Removing encryption and boot sector with file authentication If Endpoint Encryption does not work and the previous Encryption and Boot Sector Removal with token authentication cannot be used, then follow this task. CAUTION: This procedure should only be attempted under the guidance of McAfee . For this method, the system's recovery information file should be exported from the ePO server. Before you begin Before proceeding with this task, you must have the following: • The EETech (Standalone) boot disk. • The floppy drive or USB containing the Recovery Information File (.xml) • The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . Task 1
Restart the unrecoverable system using the EETech (Standalone) boot disk. This loads the McAfee EETech interface.
2
Authorize with daily Authorization code and confirm the authorization status.
3
Authenticate with Recovery Information File (.xml) and confirm the authentication status.
4
Click Remove EE under Actions. The Remove EE page appears.
5
Click Remove to begin the removal. This removes encryption and boot sector from the client system, however, this does not remove Endpoint Encryption client files. It might take a few hours depending on the system performance and the storage capacity of the drive or partition.
Viewing the workspace The workspace contains the bytes loaded from the sectors on the disk or from a file. This option opens the Workspace window which allows the s to read sector ranges from the disk and to view the contents. By default, there is nothing loaded into the workspace. The workspace is not a view of the disk, rather it is only a view of what the loads into it. The can choose to load the contents
26
McAfee EETech Guide
EETech (Standalone) Encrypting or Decrypting sectors
of sectors or the contents of a file. Once the loads any of these, it is displayed in the workspace. CAUTION: It is entirely the responsibility of the qualified system s and security managers to take appropriate precautions before performing this task. The needs to take maximum care while performing this task, otherwise, it may cause the system to become corrupt and that might result in the loss of data. McAfee for assistance on how to use the EETech workspace. Before you begin Before proceeding with this task, you must have the following: • The EETech (Standalone) boot disk. • The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . • Recovery Information File (.xml) or Authentication Token Task 1
Boot the system with the EETech (Standalone) boot disk. This loads the McAfee EETech interface.
2
Authorize with daily Authorization code and confirm the authorization status.
3
Authenticate with Token or Recovery Information File (.xml) and confirm the authentication status.
4
Click Workspace under Actions. The Workspace page appears with following options: • Load From File - It loads a previously saved workspace that was not encrypted and replaces the encrypted workspace. It just loads the bytes and displays them. • Save To File - This option saves the current values of the bytes to the file. • Load From Disk - This loads the bytes from the sectors on the disk. • Save To Disk - This option saves the current values of the bytes to the disk. • Zero Workspace - This option files the workspace with zeros. • Encrypt Workspace - This option encrypts the entire contents of the workspace. • Decrypt Workspace - This option decrypts the entire contents of the workspace. • Set workspace Alg - Use this option to select and set the desired workspace algorithm
5
Click First Sector to view the first sector from the disk.
6
Click Previous Sector to view the previous sector of the current sector from the disk.
7
Click Next Sector to view the next sector of the current sector from the disk.
8
Click Last Sector to view the last sector from the disk.
Encrypting or Decrypting sectors This option allows you to safely manipulate which sectors are encrypted on the disk. This option follows the crypt list to validate the ranges you submit, so it does not encrypt sectors which are currently encrypted, and will not decrypt sectors which are currently not encrypted. This option s power fail protection.
McAfee EETech Guide
27
EETech (Standalone) Restoring the MBR (Master Boot Record)
Crypt Sector option cannot be used if Endpoint Encryption has become corrupt on the disk, or the crypt state has been corrupted, however, the Force Crypt Sectors option can be used in such cases. While changing the encryption state with this option, it effects with appropriate modifications to the disk Crypt List. For example, while you encrypt a new range, it creates a new Region definition. While you decrypt within an existing Region, the existing region is split into two, if you completely decrypt a region, it removes the Region from the crypt list. CAUTION: It is entirely the responsibility of the qualified system s and security managers to take appropriate precautions before performing this task. The needs to take maximum care while performing this task, otherwise, it may cause the system to become corrupt and that might result in the loss of data. Before you begin Before proceeding with this task, you must have the following: • The EETech (Standalone) boot disk. • The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . • Recovery Information File (.xml) or Authentication Token Task 1
Boot the system with the EETech (Standalone) boot disk. This loads the McAfee EETech interface.
2
Authorize with daily Authorization code and confirm the authorization status.
3
Authenticate with Token or Recovery Information File (.xml) and confirm the authentication status.
4
Select the disk from the Select Disk list, then type the Start Sector and the Number of Sectors.
5
Click Set Boot Disk and select the relevant boot disk from the Set Boot Disk page.
6
Click Set Algorithm and select the desired algorithm from the Select Algorithm page.
7
Click Crypt Sectors and select the disk from the Select Disk list, then type the Start Sector and the Number of Sectors.
8
Click Encrypt/Decrypt to encrypt/decrypt a range of sectors.
Restoring the MBR (Master Boot Record) The MBR is the first sector of the boot disk. It is that part of the hard drive which tells the operating system what to boot and from where to boot. The MBR loads the boot sector which in turn will load the operating system. The MBR of a EEPC installed system is stored in ePO during the EEPC deployment and can therefore be exported as part of the Recovery Information file (.xml). Before you begin Before proceeding with this task, you must have the following:
28
McAfee EETech Guide
EETech (Standalone) Restoring the MBR (Master Boot Record)
• The EETech (Standalone) boot disk. • The floppy drive or USB containing the recovery information file (.xml) and this must be plugged in before booting from the EETech (Standalone) boot disk. Task 1
Boot the system with the EETech (Standalone) boot disk. This loads the McAfee EETech interface.
2
Authorize with daily Authorization code and confirm the authorization status.
3
Authenticate with Token or Recovery Information File (.xml) and confirm the authentication status.
4
Click Restore MBR under Disk Operations. The confirmation page appears.
5
Click Yes to confirm that you want to overwrite the Master Boot Record. NOTE: While you authenticate through file or token and use this option, it replaces the code portion of the MBR with the one that was present prior to installing Endpoint Encryption. CAUTION: Restoring MBR should be performed on a system where the boot disk is not encrypted, else an error message Missing Operating System is displayed.
McAfee EETech Guide
29
Glossary There are a number of options that are common to both EETech (WinPE V1) and EETech (Standalone). These options have the similar functionalities in both recovery methods. Options or topics common to EETech (WinPE V1) and EETech (Standalone) are listed in the table below. Topic
Description
Disk Information
•
Disk Power Fail Status - Endpoint Encryption for PC tracks the progress of encryption on the drive to ensure that if power is lost during encryption, the process is recoverable.
•
Status - Determines whether the drive is currently in powerfail state. A status of Inactive indicates that the current encryption process has finished.
•
Disk Crypt List •
Crypt List Region Count - The number of defined crypted areas of this logical disk. This usually corresponds to the number of partitions on the drive. •
•
30
McAfee EETech Guide
Region - Each region is defined as follows: •
Start Sector - The physical start sector of the region
•
End Sector - The last physical sector included in the region
•
Sector Count - The number of sectors included in this region
Disk Partitions - A section per Logical partition on this physical drive as follows: •
Partition Count - The unique partition number.
•
Partition Type - The file system detected on this partition.
•
Partition Bootable - Whether the partition is bootable or not.
•
Partition Recognized - Whether the partition is recognized as viable.
•
Partition Drive Letter - The detected drive letter of this partition.
•
Partition Start Sector - The physical start sector of the partition.
•
Partition End Sector - The physical end sector of the partition.
•
Partition Sector Count - The number of sectors in the partition.
•
Partition Bus Type - Bus type used in particular partition.
Glossary
Topic Repair Disk Information
Description The Repair Disk Information option fixes problems with any disk that is set as the boot disk. For this to work the crypt list portion must still be valid and the power fail state must be inactive. The disk information is stored in a chain of sectors. If the chain of sectors breaks, then it not possible for Endpoint Encryption to figure out what parts of the disk are encrypted and hence the gets errors. The Repair Disk Information option attempts to repair the broken chain sectors. CAUTION: This option is not ed with the current McAfee EETech version.
Force Crypt Sectors
Before using this option call McAfee Technical for assistance. Unlike the Crypt Sectors | Encrypt/Decrypt option, the Force Crypt Sectors option does not consider the disk crypt state. It simply performs the operation blindly according to input. Force Crypt does not power fail, nor does it apply any logic or parameter validation on the input. You should use the Force Crypt Sectors option only when everything else fails. For example, when the on-disk structures are completely corrupted. CAUTION: This option will cause irretrievable data loss if used incorrectly. If you are forced to use this option, you should make a recording of each operation you apply to in data recovery. CAUTION: Ensure that there is no possibility of losing power while using this option as this option does not power fail protection.
Edit Disk Crypt State
The disk crypt state contains information about which range of sectors are encrypted. This option allows you to change the ranges. CAUTION: Call McAfee Technical for assistance before using this option, because using this option inappropriately will cause irretrievable data loss. CAUTION: Ensure that there is no possibility of losing power while using this option as this option does not power fail protection.
Set Algorithm
This is an option present under Disk Operations on the McAfee EETech page for setting the correct algorithm on a system.
Set Boot Disk
This option displays a list of disks from which the can select a disk to use as the boot disk.
McAfee EETech Guide
31
Index File Authentication 15
A Authenticate from file 15, 16, 17, 26, 27, 28 Authenticate from token 13, 15, 16, 26, 27 Authentication 9, 21 Authentication Code 24 Authorization 8, 20 Authorization Code 8, 20
I
B
R
ISO image 6
M Media Output 6
Create EETech Boot Disk 19 Crypt Sectors 16, 27
recovery change 12, 23 self recovery 12, 23 Recovery 6, 19 Recovery Information file 17, 26, 28 Recovery Information File 15, 24 Remove EE 13, 15, 25, 26 Restore MBR 17, 28
D
S
Decrypt 16, 26, 27 Decrypt workspace 15
Standalone boot CD/DVD 20
BartPE CD/DVD 13 BartPE CD\DVD 6 BartPe install file 6
C
T E EE credential 25 EETech 5, 6, 24 Emergency Boot 24 Encrypt 16, 26, 27 Encrypt workspace 15 Endpoint Encryption for PC 5
F file authentication 26
32
McAfee EETech Guide
token authentication 25 Token Authentication 9, 21
W WinPE 6 WinPE V1 Recovery CD/DVD 8 Workspace 15, 26
COPYRIGHT Copyright © 2010 McAfee, Inc. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of McAfee, Inc., or its suppliers or companies. TRADEMARK ATTRIBUTIONS AVERT, EPO, EPOLICY ORCHESTRATOR, FOUNDSTONE, GROUPSHIELD, INTRUSHIELD, LINUXSHIELD, MAX (MCAFEE SECURITYALLIANCE EXCHANGE), MCAFEE, NETSHIELD, PORTALSHIELD, PREVENTSYS, SECURITYALLIANCE, SITEADVISOR, TOTAL PROTECTION, VIRUSSCAN, WEBSHIELD are ed trademarks or trademarks of McAfee, Inc. and/or its s in the US and/or other countries. McAfee Red in connection with security is distinctive of McAfee brand products. All other ed and uned trademarks herein are the sole property of their respective owners. LICENSE INFORMATION License Agreement NOTICE TO ALL S: CAREFULLY READ THE APPROPRIATE LEGAL AGREEMENT CORRESPONDING TO THE LICENSE YOU PURCHASED, WHICH SETS FORTH THE GENERAL AND CONDITIONS FOR THE USE OF THE LICENSED SOFTWARE. IF YOU DO NOT KNOW WHICH TYPE OF LICENSE YOU HAVE ACQUIRED, PLEASE CONSULT THE SALES AND OTHER RELATED LICENSE GRANT OR PURCHASE ORDER DOCUMENTS THAT ACCOMPANY YOUR SOFTWARE PACKAGING OR THAT YOU HAVE RECEIVED SEPARATELY AS PART OF THE PURCHASE (AS A BOOKLET, A FILE ON THE PRODUCT CD, OR A FILE AVAILABLE ON THE WEBSITE FROM WHICH YOU ED THE SOFTWARE PACKAGE). IF YOU DO NOT AGREE TO ALL OF THE SET FORTH IN THE AGREEMENT, DO NOT INSTALL THE SOFTWARE. IF APPLICABLE, YOU MAY RETURN THE PRODUCT TO MCAFEE OR THE PLACE OF PURCHASE FOR A FULL REFUND.
2
McAfee EETech Guide
Contents Introducing McAfee EETech. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Audience. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Using this guide. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
EETech (WinPE V1). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Creating EETech WinPE V1 Recovery CD/DVD using BartPE. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Booting from EETech WinPE V1 Recovery CD/DVD. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Authorizing with daily authorization code. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 Authenticating with token. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 Exporting the recovery information file from ePO. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Authenticating with recovery file. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Performing self recovery with token authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Removing encryption and boot sector with token authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Removing encryption and boot sector with file authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Viewing the workspace. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Encrypting or Decrypting sectors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Restoring the MBR (Master Boot Record). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
EETech (Standalone). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Creating EETech (Standalone) boot disk. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Booting from the EETech (Standalone) boot disk. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Authorizing with daily authorization code. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 Authenticating with token. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Exporting the recovery information file from ePO. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Authenticating with recovery file. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Performing self recovery with token authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Performing emergency boot. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Removing encryption and boot sector with token authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Removing encryption and boot sector with file authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Viewing the workspace. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Encrypting or Decrypting sectors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Restoring the MBR (Master Boot Record). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
McAfee EETech Guide
3
Contents
Glossary. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
4
McAfee EETech Guide
Introducing McAfee EETech With data breaches on the rise, it is important to protect information assets and comply with privacy regulations. McAfee Endpoint Encryption for PC delivers powerful encryption that protects data from unauthorized access, loss, and exposure. EETech (WinPE Version 1) and EETech (Standalone) are McAfee’s disaster recovery systems used in conjunction with Endpoint Encryption for PC (EEPC). EETech (Standalone) is a disaster recovery tool that allows the to perform normal recovery functions. EETech (WinPE V1) performs the same functions under a Windows-like environment and includes greater features such as booting from BartPE and easier access to USB drives. Audience Using this guide
Audience This guide is mainly intended for qualified system s and security managers. Knowledge of basic networking and routing concepts, and a general understanding of the aims of centrally managed security is required.
Using this guide This guide helps corporate security s to understand the disaster recovery tools, EETech (Standalone) and EETech (WinPE). This document includes procedures to recover data from systems that are unrecoverable.
McAfee EETech Guide
5
EETech (WinPE V1) EETech (WinPE V1) is a disaster recovery tool that allows the to perform recovery functions. EETech (WinPE V1) performs these functions under a Windows-like environment and includes greater features such as booting from BartPE and easier access to USB drives. CAUTION: It is entirely the responsibility of the qualified system s and security managers to take appropriate precautions while using EETech (WinPE V1) recovery tool. The needs to handle the EETech Recovery tool with maximum care, otherwise, it may cause the system to become corrupt and that might result in the loss of data. Contents Creating EETech WinPE V1 Recovery CD/DVD using BartPE Booting from EETech WinPE V1 Recovery CD/DVD Authorizing with daily authorization code Authenticating with token Exporting the recovery information file from ePO Authenticating with recovery file Performing self recovery with token authentication Removing encryption and boot sector with token authentication Removing encryption and boot sector with file authentication Viewing the workspace Encrypting or Decrypting sectors Restoring the MBR (Master Boot Record)
Creating EETech WinPE V1 Recovery CD/DVD using BartPE Bart's PE Builder helps you build a "BartPE" (Bart Preinstalled Environment) bootable Windows CD/DVD from the original Windows XP Operating System. Before you create the BartPE CD/DVD, you need to have the Windows XP \i386 folder. The i386 folder holds the files used to install, repair, modify, update, and rebuild Windows. This can be found on the root directory of a Windows XP Pro/Home installation CD. Task 1
the latest BartPe install file. NOTE: Refer to http://www.nu2.nu/pebuilder/ website for the required information and links.
6
McAfee EETech Guide
EETech (WinPE V1) Creating EETech WinPE V1 Recovery CD/DVD using BartPE
2
Install BartPe to the default install locations of your local system.
3
Open Microsoft Windows Explorer and navigate to the \pebuilderxxxxx\plugin folder. NOTE: xxxxx denotes the version number of BartPE.
4
Extract EETech.zip to the desired location. Copy WinPE folder from EETech folder to the \pebuilderxxxxx\plugin folder.
5
Create a subfolder EEPC inside the \pebuilderxxxxx folder. This acts as a source folder for the Endpoint Encryption recovery files.
6
Copy the i386 folder to the root drive C:\
7
Launch BartPe. The BartPE CD/DVD Builder page appears.
Figure 1: The BartPE CD/DVD Builder window 8
Type or browse to the path for the Windows installation files in the Source field.
9
Type or browse to the path to include other files and folders from this directory in the Custom field.
10 Type a directory name in the Output field to store the files that PE Builder copies. Ensure that the location you type is relative to your \pebuilder directory. NOTE: If you need to specify an absolute path, you must change the Output path absolute in the Builder | Options dialog. 11 Use the Media output pane to specify whether you want to create a CD/DVD or an ISO image. NOTE: You can click the Plugins button to add, edit, enable/disable, configure or remove plugins from the list.
McAfee EETech Guide
7
EETech (WinPE V1) Booting from EETech WinPE V1 Recovery CD/DVD
12 Click Build to start writing the CD/DVD or build the ISO image.
Booting from EETech WinPE V1 Recovery CD/DVD EETech (WinPE) is accessed through the BartPE plug-in boot CD/DVD. When the boots the unrecoverable system with the BartPE Windows CD/DVD, the first page that appears is the Endpoint Encryption interface. This is followed by a dialogue that prompts the to start network services. You can start the network services if you have added the drivers for your Ethernet card to the CD/DVD build, otherwise click No. Task 1
Boot the unrecoverable system with the EETech WinPE V1 Recovery CD/DVD. The Endpoint Encryption interface appears.
2
Click Go | Programs | McAfee EETech. The McAfee EETech page appears.
Figure 2: McAfee EETech (WinPE) interface
Authorizing with daily authorization code Use this task to authorize the recovery tasks using the daily authorization code. Before you begin Ensure that the system’s main power supply is plugged in for this task. Do not attempt to perform this task on battery only. Before proceeding with this task, you must have the following: • The EETech WinPE V1 Recovery CD/DVD boot disk.
8
McAfee EETech Guide
EETech (WinPE V1) Authenticating with token
• The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . Task 1
Boot the system with the EETech WinPE V1 Recovery CD/DVD. This loads the Endpoint Encryption interface.
2
Click Go | Programs | McAfee EETech. The McAfee EETech page appears.
3
Click Authorize under Authorization. The Authorize dialogue appears.
4
Type the daily Authorization/Access Code and click OK. On typing the correct authorization code for the day, the Authorization status changes to Authorized.
Authenticating with token Use this task to authenticate the recovery tasks using the Endpoint Encryption credentials for the system. Before you begin Before proceeding with this task, ensure that you have the EETech WinPE V1 Recovery CD/DVD boot disk Task 1
Ensure that the system’s main power supply is plugged in for this task. Do not attempt to perform this task on battery only.
2
Boot the system with the EETech WinPE V1 Recovery CD/DVD. This loads the Endpoint Encryption interface.
3
Click Go | Programs | McAfee EETech. The McAfee EETech page appears.
McAfee EETech Guide
9
EETech (WinPE V1) Exporting the recovery information file from ePO
4
Click Token under Authentication. The Endpoint Encryption Logon page appears and prompts for the Endpoint Encryption credentials for the system.
Figure 3: Authenticate with token 5
Type the name and for the client system and click Logon. On providing the correct credential, the Authentication status changes to Authenticated with Token.
Exporting the recovery information file from ePO Use this task to export the recovery information file (.xml) for the desired system from ePO. Every system that is encrypted through ePO has a recovery information file in ePO. Any trying to authenticate the recovery procedures on the client systems should get the file from the ePO for EEPC. Before you begin You must have appropriate permissions to perform this task. Task
10
1
Insert your choice of removable media, such as floppy disk or USB drive, to the system where ePO server is present.
2
Click Menu | Systems | System Tree in ePO server. The Systems page appears. Select the desired group under System Tree pane on the left.
3
Select the desired System, then click Actions | Endpoint Encryption | Export Recovery Information. The Export Recovery Information confirmation page appears.
4
Click Yes to export the recovery information file. The Export Recovery Information page appears with the Export information (.xml) file.
McAfee EETech Guide
EETech (WinPE V1) Authenticating with recovery file
5
Right-click the .xml file and save it to the inserted removable media, such as floppy disk or USB drive. NOTE: The Recovery Information File has a general format of client system name.xml.
Authenticating with recovery file Use this task to authenticate the recovery procedures using the Recovery Information File (.xml). The needs to export the Recovery Information File for the desired system from ePO server. Before you begin Before proceeding with this task, you must have the following: • The EETech WinPE V1 Recovery CD/DVD boot disk. • The floppy drive or USB containing the Recovery Information File (.xml). • The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . Task 1
Ensure that the system’s main power supply is plugged in for this task. Do not attempt to perform this task on battery only.
2
Boot the system with the EETech WinPE V1 Recovery CD/DVD. This loads the Endpoint Encryption interface.
3
Click Go | Programs | McAfee EETech. The McAfee EETech page appears.
McAfee EETech Guide
11
EETech (WinPE V1) Performing self recovery with token authentication
4
Click File under Authentication, then browse and select the Recovery Information File (.xml) from the floppy disk or USB drive, then click OK. On selecting the right file, the Authentication status changes to Authenticated with File. NOTE: After the authorization and authentication, the McAfee EETech interface appears as shown in this figure.
Figure 4: McAfee EETech (WinPE) interface after authorization and authentication
Performing self recovery with token authentication Use this option in the client computer, if the 's or the logon token have been lost, to recover the . Before you begin The must have successfully enrolled for self recovery on the client system to perform this task. This task should be performed by the client on the client computer. Before proceeding with this task, you must have the following: • The EETech WinPE V1 Recovery CD/DVD boot disk. Task
12
1
Ensure that the system’s main power supply is plugged in for this task. Do not attempt to perform this task on battery only.
2
Boot the system with the EETech WinPE V1 Recovery CD/DVD. This loads the Endpoint Encryption interface.
3
Click Go | Programs | McAfee EETech. The McAfee EETech page appears.
4
Click Token under Authentication. The Endpoint Encryption Logon page appears and prompts for the Endpoint Encryption credentials for the .
McAfee EETech Guide
EETech (WinPE V1) Removing encryption and boot sector with token authentication
5
Click Options | Recovery. The Recovery dialog box appears with option Self-Recovery selected by default.
Figure 5: Self Recovery with token authentication 6
Type the name and click OK. The Recovery dialog box appears with the questions that the answered while enrolling for the self recovery.
7
Type the answers for the prompted questions and click Finish. The Change dialog box appears.
8
Type and confirm the New and click OK. The Logon page appears and prompts for the Endpoint Encryption credentials for the . The can now type the newly set and to the system.
Removing encryption and boot sector with token authentication Use this task in the following situations when: • Windows becomes corrupt. • You cannot access the data of an encrypted system. • Encryption or decryption fails. Before you begin Before proceeding with this task, you must have the following: • The EETech WinPE V1 Recovery CD/DVD boot disk.
McAfee EETech Guide
13
EETech (WinPE V1) Removing encryption and boot sector with token authentication
• The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . Task 1
Ensure that the system’s main power supply is plugged in for this task. Do not attempt to perform this task on battery only.
2
Boot the system with the EETech WinPE V1 Recovery CD/DVD. This loads the Endpoint Encryption interface.
3
Click Go | Programs | McAfee EETech. The McAfee EETech page appears.
4
Authorize with daily Authorization code and confirm the authorization status.
5
Authenticate with Token and confirm the authentication status.
6
Click Remove EE under Actions. The Remove EE page appears.
Figure 6: Remove Encryption 7
14
Click Remove to begin the removal. This removes encryption and boot sector from the client system, however, this does not remove Endpoint Encryption client files. It might take a few hours depending on the system performance and the storage capacity of the drive or partition.
McAfee EETech Guide
EETech (WinPE V1) Removing encryption and boot sector with file authentication
Removing encryption and boot sector with file authentication If Endpoint Encryption does not work and the previous Encryption and Boot Sector Removal with token authentication cannot be used, then follow this task. CAUTION: This procedure should only be attempted under the guidance of McAfee . For this method, the recovery information file (.xml) should be exported from ePO. Before you begin Before proceeding with this task, you must have the following: • The EETech WinPE V1 Recovery CD/DVD boot disk. • The floppy drive or USB containing the Recovery Information File (.xml). • The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . Task 1
Insert the removable media that has the Recovery Information File (.xml) exported from ePO server.
2
Boot the system with the EETech WinPE V1 Recovery CD/DVD. This loads the Endpoint Encryption interface.
3
Click Go | Programs | McAfee EETech. The McAfee EETech page appears.
4
Authorize with daily Authorization code and confirm the authorization status.
5
Authenticate with Recovery Information File (.xml) and confirm the authentication status.
6
Click Remove EE under Actions. The Remove EE page appears.
7
Click Remove to begin the removal. This removes encryption and boot sector from the client system, however, this does not remove Endpoint Encryption client files. It might take a few hours depending on the system performance and the storage capacity of the drive or partition. NOTE: Remove the client system from ePO server after removing Endpoint Encryption from the client system.
Viewing the workspace The workspace contains the bytes loaded from the sectors on the disk or from a file. This option opens the Workspace window which allows the s to read sector ranges from the disk and to view the contents. By default, there is nothing loaded into the workspace. The workspace is not a view of the disk, rather it is only a view of what the loads into it. The can choose to load the contents
McAfee EETech Guide
15
EETech (WinPE V1) Encrypting or Decrypting sectors
of sectors or the contents of a file. Once the loads any of these, it is displayed in the workspace. CAUTION: It is entirely the responsibility of the qualified system s and security managers to take appropriate precautions before performing this task. The needs to take maximum care while performing this task, otherwise, it may cause the system to become corrupt and that might result in the loss of data. McAfee for assistance on how to use the EETech Workspace. Before you begin Before proceeding with this task, you must have the following: • The EETech WinPE V1 Recovery CD/DVD boot disk. • The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . • Recovery Information File (.xml) or Authentication Token Task 1
Boot the system with the EETech WinPE V1 Recovery CD/DVD. This loads the Endpoint Encryption interface.
2
Click Go | Programs | McAfee EETech. The McAfee EETech page appears.
3
Authorize with daily Authorization code and confirm the authorization status.
4
Authenticate with Token or Recovery Information File (.xml) and confirm the authentication status.
5
Click Workspace under Actions. The Workspace page appears with following options: • Load From File -It just loads the bytes from the file and displays them. • Save To File - This option saves the current values of the bytes to the file. • Load From Disk - This loads the bytes from the sectors on the disk. • Save To Disk - This option saves the current values of the bytes to the disk. • Zero Workspace - This option files the workspace with zeros. • Encrypt Workspace - This option encrypts the entire contents of the workspace. • Decrypt Workspace - This option decrypts the entire contents of the workspace. • Set workspace Alg - Use this option to select and set the desired workspace algorithm.
6
Click First Sector to view the first sector of the workspace.
7
Click Previous Sector to view the previous sector of the current sector of the workspace.
8
Click Next Sector to view the next sector of the current sector of the workspace.
9
Click Last Sector to view the last sector of the workspace.
Encrypting or Decrypting sectors This option allows you to safely manipulate which sectors are encrypted on the disk. This option follows the crypt list to validate the ranges you submit, so that it does not encrypt sectors which
16
McAfee EETech Guide
EETech (WinPE V1) Restoring the MBR (Master Boot Record)
are currently encrypted, and does not decrypt sectors which are currently not encrypted. This option s power fail protection. Crypt Sector option cannot be used if Endpoint Encryption has become corrupt on the disk, or the crypt state has been corrupted, however, the Force Crypt Sectors option can be used in such cases. While changing the encryption state with this option, it effects with appropriate modifications to the disk Crypt List. For example, while you encrypt a new range, it creates a new Region definition. While you decrypt within an existing Region, the existing region is split into two, if you completely decrypt a region, it removes the Region from the crypt list. CAUTION: It is entirely the responsibility of the qualified system s and security managers to take appropriate precautions before performing this task. The needs to take maximum care while performing this task, otherwise, it may cause the system to become corrupt and that might result in the loss of data. Before you begin Before proceeding with this task, you must have the following: • The EETech WinPE V1 Recovery CD/DVD boot disk. • The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . • Recovery Information File (.xml) or Authentication Token Task 1
Boot the system with the EETech WinPE V1 Recovery CD/DVD. This loads the Endpoint Encryption interface.
2
Click Go | Programs | McAfee EETech. The McAfee EETech page appears.
3
Authorize with daily Authorization code and confirm the authorization status.
4
Authenticate with Token or Recovery Information File (.xml) and confirm the authentication status.
5
Click Set Boot Disk and select the relevant boot disk from the Set Boot Disk page.
6
Click Set Algorithm and select the desired algorithm from the Select Algorithm page.
7
Click Crypt Sectors and select the disk from the Select Disk list, then type the Start Sector and the Number of Sectors.
8
Click Encrypt/Decrypt to encrypt/decrypt a range of sectors.
Restoring the MBR (Master Boot Record) The MBR is the first sector of the boot disk. It is that part of the hard drive which tells the operating system what to boot and from where to boot. The MBR loads the boot sector which in turn will load the operating system. The MBR of a EEPC installed system is stored in ePO during the EEPC deployment and can therefore be exported as part of the Recovery Information file (.xml). NOTE: If you have performed a manual (forced) decrypt, then you must follow this procedure to restore the original MBR.
McAfee EETech Guide
17
EETech (WinPE V1) Restoring the MBR (Master Boot Record)
Before you begin Before proceeding with this task, you must have the following: • The EETech WinPE V1 Recovery CD/DVD boot disk. • The floppy drive or USB containing the recovery information file (.xml) and this must be plugged in before booting from The BartPE Boot CD/DVD boot CD/DVD. Task 1
Boot the system with the EETech WinPE V1 Recovery CD/DVD. This loads the Endpoint Encryption interface.
2
Click Go | Programs | McAfee EETech. The McAfee EETech page appears.
3
Authorize with daily Authorization code and confirm the authorization status.
4
Authenticate with Token or Recovery Information File (.xml) and confirm the authentication status.
5
Click Restore MBR under Disk Operations. The confirmation page appears.
6
Click Yes to confirm that you want to overwrite the Master Boot Record. NOTE: While you authenticate through file or token and use this option, it replaces the code portion of the MBR with the one that was present prior to installing Endpoint Encryption. CAUTION: Restoring MBR should be performed on a system where the boot disk is not encrypted, else an error message Missing Operating System is displayed.
18
McAfee EETech Guide
EETech (Standalone) This chapter explains some of the common tasks that can be undertaken using McAfee’s disaster recovery tool, the standalone version of the EETech. Ensure that you exercise caution for all EETech procedures. Contents Creating EETech (Standalone) boot disk Booting from the EETech (Standalone) boot disk Authorizing with daily authorization code Authenticating with token Exporting the recovery information file from ePO Authenticating with recovery file Performing self recovery with token authentication Performing emergency boot Removing encryption and boot sector with token authentication Removing encryption and boot sector with file authentication Viewing the workspace Encrypting or Decrypting sectors Restoring the MBR (Master Boot Record)
Creating EETech (Standalone) boot disk McAfee EETech (Standalone) enhances the experience with a simplified process of creating the EETech boot disk. You can create the boot disk just by running a simple command from the command prompt. Before you begin Before proceeding with this task, you must have the following: • A: drive in your computer • A floppy disk Task 1
Extract EETech.zip and place the Standalone folder in the desired location.
2
Insert the floppy disk.
3
Point to the Standalone folder from the command prompt.
McAfee EETech Guide
19
EETech (Standalone) Booting from the EETech (Standalone) boot disk
4
Run the command Bootdisk.exe EETech.RTB a: from the command prompt. This creates the bootable floppy.
5
Create a boot disk CD/DVD using this bootable floppy.
Booting from the EETech (Standalone) boot disk EETech (Standalone) is accessed through the EETech Standalone boot CD/DVD. When the boots the unrecoverable system with the EETech Standalone boot disk, the first page that appears is the McAfee EETech interface. Task 1
Boot the unrecoverable system with the EETech (Standalone) boot CD/DVD. The McAfee EETech interface appears.
Figure 7: McAfee EETech (Standalone) interface
Authorizing with daily authorization code Use this task to authorize the recovery tasks using the daily authorization code. Before you begin Before proceeding with this task, you must have the following: • The EETech (Standalone) boot disk. • The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee .
20
McAfee EETech Guide
EETech (Standalone) Authenticating with token
Task 1
Ensure that the system’s main power supply is plugged in for this task. Do not attempt to perform this task on battery only.
2
Restart the unrecoverable system using the EETech (Standalone) boot disk. This loads the McAfee EETech interface.
3
Click Authorize under Authorization. The Authorize dialogue appears.
4
Type the daily Authorization/Access Code and click OK. On typing the correct authorization code for the day, the Authorization status changes to Authorized.
Authenticating with token Use this task to authenticate the recovery tasks using the Endpoint Encryption credentials for the system. Before you begin Before proceeding with this task, you must have the following: • The EETech (Standalone) boot disk. • The floppy drive or USB containing the Recovery Information File (.xml). Task 1
Ensure that the system’s main power supply is plugged in for this task. Do not attempt to perform this task on battery only.
2
Restart the unrecoverable system using the EETech (Standalone) boot disk. This loads the McAfee EETech interface.
3
Click Token under Authentication. The Endpoint Encryption Logon page appears and prompts for the Endpoint Encryption credentials for the system.
4
Type the name and for the client system and click Logon. On typing the correct credential, the Authentication status changes to Authenticated with Token.
Exporting the recovery information file from ePO Use this task to export the recovery information file (.xml) for the desired system from ePO. Every system that is encrypted through ePO has a recovery information file in ePO. Any trying to authenticate the recovery procedures on the client systems should get the file from the ePO for EEPC. Before you begin You must have appropriate permissions to perform this task. Task 1
Insert your choice of removable media, such as floppy disk or USB drive, to the system where ePO server is present.
2
Click Menu | Systems | System Tree in ePO server. The Systems page appears. Select the desired group under System Tree pane on the left.
McAfee EETech Guide
21
EETech (Standalone) Authenticating with recovery file
3
Select the desired System, then click Actions | Endpoint Encryption | Export Recovery Information. The Export Recovery Information confirmation page appears.
4
Click Yes to export the recovery information file. The Export Recovery Information page appears with the Export information (.xml) file.
5
Right-click the .xml file and save it to the inserted removable media, such as floppy disk or USB drive. NOTE: The Recovery Information File has a general format of client system name.xml.
Authenticating with recovery file Use this task to authenticate the recovery tasks using the Recovery Information File (.xml). The needs to export the Recovery Information File for the desired system from ePO server. Before you begin Before proceeding with this task, you must have the following: • The EETech (Standalone) boot disk. • The floppy drive or USB containing the Recovery Information File (.xml). Task
22
1
Ensure that the system’s main power supply is plugged in for this task. Do not attempt to perform this task on battery only.
2
Restart the unrecoverable system using the EETech (Standalone) boot disk. This loads the McAfee EETech interface.
McAfee EETech Guide
EETech (Standalone) Performing self recovery with token authentication
3
Click File under Authentication, then browse and select the Recovery Information File (.xml) from the floppy disk or USB drive, then click OK. On selecting the right file, the Authentication status changes to Authenticated with File. NOTE: After the authorization and authentication, the McAfee EETech interface appears as shown in this figure.
Figure 8: McAfee EETech (Standalone) interface after authorization and authentication
Performing self recovery with token authentication Use this option in the client computer, if the 's or the logon token have been lost, to recover the . Before you begin The must have successfully enrolled for self recovery on the client system to perform this task. This task should be performed by the client on the client computer. Before proceeding with this task, you must have the following: • The EETech (Standalone) boot disk. Task 1
Ensure that the system’s main power supply is plugged in for this task. Do not attempt to perform this task on battery only.
2
Restart the unrecoverable system using the EETech (Standalone) boot disk. This loads the McAfee EETech interface.
3
Click Token under Authentication. The Endpoint Encryption Logon page appears and prompts for the Endpoint Encryption credentials for the .
4
Click Options | Recovery. The Recovery dialog box appears with Self-Recovery as a default option.
5
Type the name and click OK. The Recovery dialog box appears with the questions that the answered while enrolling for the self recovery.
McAfee EETech Guide
23
EETech (Standalone) Performing emergency boot
6
Type the answers for the prompted questions and click Finish. The Change dialog box appears.
7
Type and confirm the New and click OK. The Logon page appears and prompts for the Endpoint Encryption credentials for the . The can now type the newly set and to the system.
Performing emergency boot You can perform the emergency boot when an EEPC installed system fails to boot or when the Endpoint Encryption logon page is corrupt. Before you begin Before proceeding with this task, you must have the following: • The EETech (Standalone) boot disk. • The floppy drive or USB containing the Recovery Information File (.xml). • The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . Task 1
Restart the unrecoverable system using the EETech (Standalone) boot disk. This loads the McAfee EETech interface.
2
Authorize with daily Authorization code and confirm the authorization status.
3
Click Enable USB under Actions. The McAfee EETech dialogue appears with the USB enabled message.
4
Click OK to close the dialogue.
5
Click File under Authentication, then browse and select the Recovery Information File (.xml) from the floppy disk or USB drive, then click OK. On selecting the right file, the Authentication status changes to Authenticated with File.
6
Click Emergency Boot under Actions. The EETech will now emergency boot into the operating system message appears.
7
Click OK to confirm the emergency boot. NOTE: This may modify the MBR. When the system boots into Windows, if there is a network connection to the ePO server, then the system synchronizes with ePO and fully repairs itself. You can confirm this by right-clicking McAfee Agent Tray, then clicking Quick Settings | Endpoint Encryption status. NOTE: If the McAfee Agent is unable to establish connection with the ePO Server, continue to use the EETech Emergency Boot option to boot the system until a connection to the server is made.
24
McAfee EETech Guide
EETech (Standalone) Removing encryption and boot sector with token authentication
Removing encryption and boot sector with token authentication Use this task in the following situations when: • Windows becomes corrupt. • You cannot access the data of an encrypted system. • Encryption or decryption fails. Before you begin Before proceeding with this task, you must have the following: • The EETech (Standalone) boot disk. • The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . Task 1
Ensure that the system’s main power supply is plugged in for this task. Do not attempt to perform this task on battery only.
2
Restart the unrecoverable system using the EETech (Standalone) boot disk. This loads the McAfee EETech interface.
3
Authorize with daily Authorization code and confirm the authorization status.
4
Authenticate with Token and confirm the authentication status.
5
Click Remove EE under Actions. The Remove EE page appears.
Figure 9: Remove Encryption
McAfee EETech Guide
25
EETech (Standalone) Removing encryption and boot sector with file authentication
6
Click Remove to begin the removal. This removes encryption and boot sector from the client system, however, this does not remove Endpoint Encryption client files. It might take a few hours depending on the system performance and the storage capacity of the drive or partition.
Removing encryption and boot sector with file authentication If Endpoint Encryption does not work and the previous Encryption and Boot Sector Removal with token authentication cannot be used, then follow this task. CAUTION: This procedure should only be attempted under the guidance of McAfee . For this method, the system's recovery information file should be exported from the ePO server. Before you begin Before proceeding with this task, you must have the following: • The EETech (Standalone) boot disk. • The floppy drive or USB containing the Recovery Information File (.xml) • The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . Task 1
Restart the unrecoverable system using the EETech (Standalone) boot disk. This loads the McAfee EETech interface.
2
Authorize with daily Authorization code and confirm the authorization status.
3
Authenticate with Recovery Information File (.xml) and confirm the authentication status.
4
Click Remove EE under Actions. The Remove EE page appears.
5
Click Remove to begin the removal. This removes encryption and boot sector from the client system, however, this does not remove Endpoint Encryption client files. It might take a few hours depending on the system performance and the storage capacity of the drive or partition.
Viewing the workspace The workspace contains the bytes loaded from the sectors on the disk or from a file. This option opens the Workspace window which allows the s to read sector ranges from the disk and to view the contents. By default, there is nothing loaded into the workspace. The workspace is not a view of the disk, rather it is only a view of what the loads into it. The can choose to load the contents
26
McAfee EETech Guide
EETech (Standalone) Encrypting or Decrypting sectors
of sectors or the contents of a file. Once the loads any of these, it is displayed in the workspace. CAUTION: It is entirely the responsibility of the qualified system s and security managers to take appropriate precautions before performing this task. The needs to take maximum care while performing this task, otherwise, it may cause the system to become corrupt and that might result in the loss of data. McAfee for assistance on how to use the EETech workspace. Before you begin Before proceeding with this task, you must have the following: • The EETech (Standalone) boot disk. • The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . • Recovery Information File (.xml) or Authentication Token Task 1
Boot the system with the EETech (Standalone) boot disk. This loads the McAfee EETech interface.
2
Authorize with daily Authorization code and confirm the authorization status.
3
Authenticate with Token or Recovery Information File (.xml) and confirm the authentication status.
4
Click Workspace under Actions. The Workspace page appears with following options: • Load From File - It loads a previously saved workspace that was not encrypted and replaces the encrypted workspace. It just loads the bytes and displays them. • Save To File - This option saves the current values of the bytes to the file. • Load From Disk - This loads the bytes from the sectors on the disk. • Save To Disk - This option saves the current values of the bytes to the disk. • Zero Workspace - This option files the workspace with zeros. • Encrypt Workspace - This option encrypts the entire contents of the workspace. • Decrypt Workspace - This option decrypts the entire contents of the workspace. • Set workspace Alg - Use this option to select and set the desired workspace algorithm
5
Click First Sector to view the first sector from the disk.
6
Click Previous Sector to view the previous sector of the current sector from the disk.
7
Click Next Sector to view the next sector of the current sector from the disk.
8
Click Last Sector to view the last sector from the disk.
Encrypting or Decrypting sectors This option allows you to safely manipulate which sectors are encrypted on the disk. This option follows the crypt list to validate the ranges you submit, so it does not encrypt sectors which are currently encrypted, and will not decrypt sectors which are currently not encrypted. This option s power fail protection.
McAfee EETech Guide
27
EETech (Standalone) Restoring the MBR (Master Boot Record)
Crypt Sector option cannot be used if Endpoint Encryption has become corrupt on the disk, or the crypt state has been corrupted, however, the Force Crypt Sectors option can be used in such cases. While changing the encryption state with this option, it effects with appropriate modifications to the disk Crypt List. For example, while you encrypt a new range, it creates a new Region definition. While you decrypt within an existing Region, the existing region is split into two, if you completely decrypt a region, it removes the Region from the crypt list. CAUTION: It is entirely the responsibility of the qualified system s and security managers to take appropriate precautions before performing this task. The needs to take maximum care while performing this task, otherwise, it may cause the system to become corrupt and that might result in the loss of data. Before you begin Before proceeding with this task, you must have the following: • The EETech (Standalone) boot disk. • The daily Authorization/Access code. NOTE: s with a valid contract with McAfee can obtain the daily Authorization code from McAfee . • Recovery Information File (.xml) or Authentication Token Task 1
Boot the system with the EETech (Standalone) boot disk. This loads the McAfee EETech interface.
2
Authorize with daily Authorization code and confirm the authorization status.
3
Authenticate with Token or Recovery Information File (.xml) and confirm the authentication status.
4
Select the disk from the Select Disk list, then type the Start Sector and the Number of Sectors.
5
Click Set Boot Disk and select the relevant boot disk from the Set Boot Disk page.
6
Click Set Algorithm and select the desired algorithm from the Select Algorithm page.
7
Click Crypt Sectors and select the disk from the Select Disk list, then type the Start Sector and the Number of Sectors.
8
Click Encrypt/Decrypt to encrypt/decrypt a range of sectors.
Restoring the MBR (Master Boot Record) The MBR is the first sector of the boot disk. It is that part of the hard drive which tells the operating system what to boot and from where to boot. The MBR loads the boot sector which in turn will load the operating system. The MBR of a EEPC installed system is stored in ePO during the EEPC deployment and can therefore be exported as part of the Recovery Information file (.xml). Before you begin Before proceeding with this task, you must have the following:
28
McAfee EETech Guide
EETech (Standalone) Restoring the MBR (Master Boot Record)
• The EETech (Standalone) boot disk. • The floppy drive or USB containing the recovery information file (.xml) and this must be plugged in before booting from the EETech (Standalone) boot disk. Task 1
Boot the system with the EETech (Standalone) boot disk. This loads the McAfee EETech interface.
2
Authorize with daily Authorization code and confirm the authorization status.
3
Authenticate with Token or Recovery Information File (.xml) and confirm the authentication status.
4
Click Restore MBR under Disk Operations. The confirmation page appears.
5
Click Yes to confirm that you want to overwrite the Master Boot Record. NOTE: While you authenticate through file or token and use this option, it replaces the code portion of the MBR with the one that was present prior to installing Endpoint Encryption. CAUTION: Restoring MBR should be performed on a system where the boot disk is not encrypted, else an error message Missing Operating System is displayed.
McAfee EETech Guide
29
Glossary There are a number of options that are common to both EETech (WinPE V1) and EETech (Standalone). These options have the similar functionalities in both recovery methods. Options or topics common to EETech (WinPE V1) and EETech (Standalone) are listed in the table below. Topic
Description
Disk Information
•
Disk Power Fail Status - Endpoint Encryption for PC tracks the progress of encryption on the drive to ensure that if power is lost during encryption, the process is recoverable.
•
Status - Determines whether the drive is currently in powerfail state. A status of Inactive indicates that the current encryption process has finished.
•
Disk Crypt List •
Crypt List Region Count - The number of defined crypted areas of this logical disk. This usually corresponds to the number of partitions on the drive. •
•
30
McAfee EETech Guide
Region - Each region is defined as follows: •
Start Sector - The physical start sector of the region
•
End Sector - The last physical sector included in the region
•
Sector Count - The number of sectors included in this region
Disk Partitions - A section per Logical partition on this physical drive as follows: •
Partition Count - The unique partition number.
•
Partition Type - The file system detected on this partition.
•
Partition Bootable - Whether the partition is bootable or not.
•
Partition Recognized - Whether the partition is recognized as viable.
•
Partition Drive Letter - The detected drive letter of this partition.
•
Partition Start Sector - The physical start sector of the partition.
•
Partition End Sector - The physical end sector of the partition.
•
Partition Sector Count - The number of sectors in the partition.
•
Partition Bus Type - Bus type used in particular partition.
Glossary
Topic Repair Disk Information
Description The Repair Disk Information option fixes problems with any disk that is set as the boot disk. For this to work the crypt list portion must still be valid and the power fail state must be inactive. The disk information is stored in a chain of sectors. If the chain of sectors breaks, then it not possible for Endpoint Encryption to figure out what parts of the disk are encrypted and hence the gets errors. The Repair Disk Information option attempts to repair the broken chain sectors. CAUTION: This option is not ed with the current McAfee EETech version.
Force Crypt Sectors
Before using this option call McAfee Technical for assistance. Unlike the Crypt Sectors | Encrypt/Decrypt option, the Force Crypt Sectors option does not consider the disk crypt state. It simply performs the operation blindly according to input. Force Crypt does not power fail, nor does it apply any logic or parameter validation on the input. You should use the Force Crypt Sectors option only when everything else fails. For example, when the on-disk structures are completely corrupted. CAUTION: This option will cause irretrievable data loss if used incorrectly. If you are forced to use this option, you should make a recording of each operation you apply to in data recovery. CAUTION: Ensure that there is no possibility of losing power while using this option as this option does not power fail protection.
Edit Disk Crypt State
The disk crypt state contains information about which range of sectors are encrypted. This option allows you to change the ranges. CAUTION: Call McAfee Technical for assistance before using this option, because using this option inappropriately will cause irretrievable data loss. CAUTION: Ensure that there is no possibility of losing power while using this option as this option does not power fail protection.
Set Algorithm
This is an option present under Disk Operations on the McAfee EETech page for setting the correct algorithm on a system.
Set Boot Disk
This option displays a list of disks from which the can select a disk to use as the boot disk.
McAfee EETech Guide
31
Index File Authentication 15
A Authenticate from file 15, 16, 17, 26, 27, 28 Authenticate from token 13, 15, 16, 26, 27 Authentication 9, 21 Authentication Code 24 Authorization 8, 20 Authorization Code 8, 20
I
B
R
ISO image 6
M Media Output 6
Create EETech Boot Disk 19 Crypt Sectors 16, 27
recovery change 12, 23 self recovery 12, 23 Recovery 6, 19 Recovery Information file 17, 26, 28 Recovery Information File 15, 24 Remove EE 13, 15, 25, 26 Restore MBR 17, 28
D
S
Decrypt 16, 26, 27 Decrypt workspace 15
Standalone boot CD/DVD 20
BartPE CD/DVD 13 BartPE CD\DVD 6 BartPe install file 6
C
T E EE credential 25 EETech 5, 6, 24 Emergency Boot 24 Encrypt 16, 26, 27 Encrypt workspace 15 Endpoint Encryption for PC 5
F file authentication 26
32
McAfee EETech Guide
token authentication 25 Token Authentication 9, 21
W WinPE 6 WinPE V1 Recovery CD/DVD 8 Workspace 15, 26
Related Documents c2h70
Mcafee Eetech 2841b
December 2019 42
Latium Mcafee 5w411m
April 2023 0
Mcafee - Requisitos Del Sistema 5031h
May 2021 0
Mcafee Emm 12.0 Installation Guide 221l2b
November 2019 30
Mcafee Gti Proxy 1.0 Installationguide 3w2i1d
November 2022 0
Mcafee Data Loss Prevention 10.0.100_dlp 5b5z2f
November 2019 73More Documents from "Saravanan Rajappa" 704f1z
Mcafee Eetech 2841b
December 2019 42
2. Plasco Overview By Plasco Ltd - Mwanza Presentations g6722
December 2019 50
Adc_4-20_v1.2_en 5d2y1a
July 2022 0
Dsr 2016 In Ms Excel 354z5j
December 2021 0
Hawke Connectors 5r2bc
December 2019 59