Hi

I have a small problem. Ran Defraggler last night, now my PC won't boot up.

After a couple of hours Googling, I think I've found the cause of the problem. There are a couple of system files which should never be moved (http://support.microsoft.com/kb/227350) -

> Moving the following files (if present) can cause desktop problems:
>
> Safeboot.fs
> Safeboot.csv
> Safeboot.rsv
> Bootsec.doc

As the error message reads "Safeboot has been corrupted (error 92h)", I presume it relates to the safeboot.fs file referred to above. This message is shown before any attempt to load Windows.

Could somebody please tell me if it's possible to move this safeboot.fs file back to its original location?

Can we just clear one thing up, is this Safeboot a laptop tracking software you have on it to prevent theft?

Or are you talking about the actual safeboot keys in the registry? You cannot boot into safe mode?

What operating system?

Were your virus/malware scans clean?

Safeboot is an OTFE program written by CBI. McAfee recently bought them for $750m and claims to have an installed-base of over 5 million users. HP also offers it as an option on its range of laptops.

From what I can gather, Safeboot replaces the MBR with its own version. The Safeboot MBR loads the decryption driver which unlocks the drive and allows Windows to start up normally.

I am assuming that the modified MBR points to the physical location on the HDD where safeboot.fs is stored. As this file has been moved, the Safeboot MBR does not know where to find it.

My theory is that by moving the safeboot.fs file back to its original location, the Safeboot MBR will be able to see it again. However, this relies on -

a) It is possible to relocate a file to a specific location on the disk.

There is some way to debug the Safeboot MBR to see what address it expects to find the safeboot.fs file located at.

Any comments or suggestions on how I go about achieving this would be very welcome.

The machine is running Windows XP, and was virus-free a few days ago when last scanned.

I am not sure if the safeboot files you mention will have been moved as they are windows files.

Your problem seems to be with the safeboot encryption program files.

What actual access at all have you got on the laptop at the moment?

Is there any error number given?

The problem and error code are documented in the following article -

https://knowledge.mcafee.com/article/989/61...SAL_Public.html

Problem

When booting up a client machine with SafeBoot Device Encryption installed, you see the following error indicating that SafeBoot is corrupt:

SafeBoot is corrupt, Error 92H

Change or Cause

This is due to a corruption or relocation of the SafeBoot file system.


Their solution involves creating a bootable floppy and running their recovery application 'SafeTech'. However, what the article does not tell you is that you are required to enter a 4-digit password before it will do anything useful. This password is a hash of the current day, so to guess it you would need to enter up to 10,000 possible combinations before midnight - or the code will change to something else. I was hoping to find a less challenging solution.

By now, I'm sure you're wondering why I don't just contact Safeboot support for assistance. The problem here is that the line of Safeboot I have installed (i.e. Solo) was discontinued a few years ago. Up until a few months ago, there was a good chance that CBI would have provided some assistance. However, since being acquired by McAfee their support is only reachable via McAfee's general helpdesk - which is pretty impregnable even for support on its current range of products. So-far I have been unable to find anyone in McAfee who has even heard of Safeboot.

Hence my desire to work-out what Defraggler did to the disk and attempt to reverse it.

Having just read up about it I can see the extent of your problem in accessing the computer.

The nearest I could get was an email address for encryption solutions where I believe you would have to cite the document number that relates to either Safeboot 4 or Safeboot 5.

ebssales*at*mcafee.com

I really don't know why Defraggler would move those files which are standard 'unmovable' windows files or even if it did.

Unfortunately I cannot see anyway around the encryption issue apart from trying McAfee, which as you already now, could be difficult.

For other readers of this topic.

I would never Encrypt my hard drive as I don't work for CSIS, CIA, FBI MI5 nor Interpol so anything on my hard drive is not really very interesting except maybe I like to watch The Simpsons , BlackAdder and occasionally Keeping Up Appearances and Yes Minister.

I live by Murphy's Law where he rules supreme within the realm of the PC.

That is your choice Kenny, this user has used encryption and has a serious problem.

He has asked for help with it, so please try to offer advice if you can, which may help towards a solution rather than just stating that you wouldn't encrypt your drive.

YoKenny, my day-job involves databases and writing interfaces that exchange data with clients and suppliers. My company has allowed me to work-from-home a few days a week, so long as I can show that any data on my PC is secure. Hence the need for Safeboot.

I'm sorry, but I have neither the time nor energy to debate the merits of encryption with you right now.


Hazelnut, thanks for keeping this discussion on-topic. I also appreciate your suggestion of emailing encryption solutions. I will give that a go and see what develops.



I haven't been too diligent in my backups of late (I know ), so I really don't want to fdisk the PC and start again. If I still haven't resolved this a week from now, I think I will have to buy a replacement HDD to reinstall XP onto - and hope that I can recover the disk at a later date.

If I find a solution, I will update this thread. If you're reading this months/years from now and I have not replied, then assume the worst - you will need to reformat your drive.

I apologize.

I did not understand.

Assuming the safeboot file was moved somewhere on the disk and the MBR doesn't know where it is you
may want to consider the following.

There are disk editors out there (i.e. Acronis Disk Director) or free ones which allow one to do a raw edit
of the disk track by track and sector by sector. The data could be displayed in raw mode or hex mode.
Thus, one starts at location zero where the MBR is at to find out where it thinks the disk drive sector location
is for the safeboot file. Then reading the directory structures, one locates the safeboot file and reads the
starting disk location of where it currently is at. Now that one knows the current location, one can modify
the MBR data entry with this new location so that when you save and exit it will now know were to go.

A Problem with the above method.
Because the drive is encrypted, the raw data that you see in the editor will also will be scrambled/encrypted
and perhaps the data too for the MBR. Hence the above method will not work for encrypted drives,
but only for those that don't have it which then makes the safeboot file problem not a problem since one
wouldn't have it installed if the disk wasn't encrypted.

Maybe another way is to,
a). bootup a second disk that has it's operating system encrypted with the same set of keys.
b ). since both the new bootable OS and the non-Bootable disk use the same set of keys, one could
(maybe) mount the non-bootable drive onto the good OS that was booted.
c). Since the same keys are used and maybe encrypted the same way, one could see all the files that
are important (i.e. company, personal files) and copy them off the mounted drive onto the good drive.
After this is done one could just unmount it since one has all the important data.
d). after doing this, one could just reformat the other bad drive or continue with the new one.

The above are some possible thoughts that may work, or the only recourse is the vendor to help out.


Note: Before doing any of the above, I would suggest imaging the bad drives data and saving it on another
drive. Do the playing around of the bad OS, and should it not work or you do something wrong, you'd still
have the copy of the original bad disk drive as a disk image which could be restored back to the drive
to keep playing around forever.

I haven't heard anything from ebssales yet, but I did manage to find the email address of one of the developers of SafeBoot from alt.security.scramdisk. He replied quite promptly that without a file called SBCONFIG, I was up a stream without a paddle. This file contains the actual AES key required to decrypt the disk and is protected by the password you enter to logon to SafeBoot. Unfortunately there was a bug with SafeBoot at the time I bought it that caused the file to bloat to over 5MB, making it impossible to write to a 1.44MB floppy disk. When I installed the program and created the recovery disk, I basically created something that was completely useless.

Anyway, I think I can discount any useful assistance from SB/McAfee. I ordered a new Seagate drive today, so I can get my main PC back up and running. I also made a couple of experiments on this old Athlon XP PC (which was also running SBS) with some utilities from sysinternals.com. To cut a long story short, I screwed this PC up as well and have spent the last hour reinstalling XP. This is not one of my better weeks.

If anything positive came out of these experiments, it is confirmation that the safeboot.fs file is the one that doesn't like being moved. However, even with a copy of SBCONFIG, the recovery program failed to restore the drive to a working state.

I haven't given up trying to recover my data yet, but the Wikipedia entry on the MBR refers to it containing machine code - as opposed to a pointer to the next bootstrap file. In which case, I am definitely out of my league and should probably give up now.

I still have a bit of hair left, so I'll give it a few more days.

Thanks for keeping us up to date with your ''progress''.

It wasn't good news to read that the recovery cd made at install was basically just a coaster. What a time to find that out.

I certainly wouldn't give up on it, with the persistance you seem to have you may just hit on something.

I would imagine that when you are all up and running again you will become the ''backup king of the computer world''

Keep in touch with how you are going on. You never know someone may add to this thread with a pointer in the right direction.

Had the same problem (safboot) left on HDD after its format.

Small DOS program called MBRFix solved the problem.
http://www.sysint.no/Download/tabid/162/la...NO/Default.aspx


Cheers

The 'Safeboot' the original poster is talking about is a piece of encyption software which makes it's own modified version of MBR.

If you read what the poster said here

From what I can gather, Safeboot replaces the MBR with its own version. The Safeboot MBR loads the decryption driver which unlocks the drive and allows Windows to start up normally.

I am assuming that the modified MBR points to the physical location on the HDD where safeboot.fs is stored. As this file has been moved, the Safeboot MBR does not know where to find it.

You can now see what a difficult situation he is in.

But thanks for the MBRfix you posted anyway. It may help users who have that problem

Oh, you are wright not the same.
We had safeboot installed and wanted to use the disk again after the format. Changed MBR didn't allow to boot a disk, even with Windows partially installed on it (using bootable CD).

The problem sb2k has is serious indeed...

I remember in my company we sent to IT another corrupted disk (couldn't boot for some reason and data couldn't be resored using "standard" software).
IT department managed to get all the data (software from Safboot vendor?) and reinstall the system.

Thus, maybe if you can get the data back, fix MBR, reinstall the system and Safeboot if needed.

Sorry for confusion.

@sb2k

You certainly *do* have a problem there. I wish you the best of luck in trying to fix it, but it looks like you might be out of luck, given the lack of available support.

But I do have some advice for the future: no doubt you will still need to use encryption (for your stated reasons), so why not use TrueCrypt ?
[ http://www.truecrypt.org/ ]

...This is widely respected open source freeware, and can be used in a number of ways, for example...

1) You can encrypt the entire hard disk (as you did with Safeboot)

2) You could reserve some space on your hard drive for a virtual encrypted disk

3) You can use it in "installed" or "portable" modes.

Being FOSS, it is still well maintained, the most recent update being July 8th.

[ Apologies if you already know all about it... ]

-thm

Hey SB! Sorry to hear about your week. My last three weeks have been very similar to yours. During my struggles, I came across a company and their software that may stand you in good stead right about now. They have two programs that might help you. One is free, and one is free to try. Go to http://www.dtidata.com/ and check out their data recovery software programs (which one depends on your OS) and also take a look at their NTFS Partition Repair Tool. I have read hat your issue is, but take a look at their write-up on their software before you decide it won't help you just based on the name.

I am not affiliated with them at all by the way. I am just a fellow floundering pc hobbyist. I called the company when I had a question and they were very nice and helpful, so I was impressed.

Good luck.

You're lucky most just send a phone number to their tech in WhoKnowsWhereLand, or have you go to their support documentation.

350 million...

In order to correct this issue, you will need to perform an emergency boot. Also, the MS defrag utility does not have this problem as those files are excluded by MS.

Cheese I suggest you read all the thread.

He is /was using encryption. No such option as emergency boot available to him.

I know what he is using, and yes, for a 92H, there IS an "emergency boot" option, he need to talk to his IT department and find out who supports the Safeboot. They can call, get a "code of the day" and perform this and it will correct this, the reason the 92H came up is because he did use this utility, any third party utility, unless those files are excluded, will always bring up that particular error.

The support for his version of safeboot is limited now as he said.

If his IT people still support it, they can do this, even with limited support from customer service. They need a Safetech disk, a code of the day, and if they know how to do the steps, it takes 10 min or so to get it back up and running.

I have had to deal with this software in my profession for close to 2 years, I am very familiar with how it works and what needs to be done

It may be of help to the original poster if you drop him a pm perhaps via the forum.

I'm sure he would be glad of even a glimmer of hope.

I'll do that when I get home tonight

I'm running SafeBoot v5.2 on a Dell laptop and have had training from McAfee on it. Unfortunately, there is no way to gain access to an encrypted machine with out the daily access code from McAfee or a valid login ID on the machine with the SafeBoot client installed. This is client-server technology and a server administrator can reset the SafeBoot p/w if needed. From the SafeBoot Admin console, there is an option to decrypt the machine, but it has to be able to synch to the SafeBoot server to do that.

Neither resetting a p/w or having the daily code from McAfee will solve the problem of defraggler moving the safeboot.fs which sounds strange to me. I know of no way to move it back, if it actually was moved. McAfee SafeBoot tech support may help. In the admin guide I have the # is 877-330-2424 and supportus@safeboot.com I'm not sure who is responding to that or if it's from Control Break or McAfee... Good luck. I'm betting on a fdisk and reinstall solution is all you're going to be able to do. If that's the case, McAfee has a BartPE with WinTech (which requires the daily access code) to get you into a functioning encrypted hard drive to save data off before rebuilding.

Again, he can have his Safeboot admin perform an Emergency Boot, this issue CAN be corrected, and also, the supportus@safeboot.com is no longer a valid email address.

I think you are wasting time trying to circumvent SAfeBoot encryption and tweaking the MBR and SFBR. Whenever a file is written to supported storage media the SafeBoot Content Encryption filter executes assigned encryption policies and encrypts the file if applicable. When an application later reads the file, the encryption filter automatically decrypts the file when it is read into memory. The source file always remains encrypted on disk.
When the application closes the file, the memory is wiped and the original file is still encrypted on disk. No decrypted traces of the file remain in RAM.

Encrypted folders and files are always visible to the user. Thus, the user can search for, and will recognize files and folders as before encryption. A small key hole icon can be optionally attached to the file or folder icon, marking it as encrypted.

You can create a policy from the SafeBoot Management Centre, and then create an install set from it. When the SafeBoot Content Encryption client then is installed, the user that logs on will be forced to retrieve the proper policy assigned to him/her in the central database.

With central management using the SafeBoot Administration System, and distribution of encryption keys using the secure SafeBoot Server, it is easy to allow sharing of encrypted files within an organization. By assigning groups of users to encryption keys, the users in the group can exchange and read encrypted files like any other file, without noticing any difference. Users not assigned to the key will not be able to read files encrypted with that key.
SafeBoot Content Encryption encrypts the Windows' pagefile. This feature is automatic and cannot be configured or disabled. The pagefile is encrypted with a temporary encryption key created at each boot occasion. Thus, the pagefile encryption key is discarded once the computer shuts down, while the pagefile still is encrypted.

McAfee now has a windows version of SafeTech which runs from a BartPE, but you still need the daily authorization code to get past the encryption.

It's called Wintech, and it's a bootable CD, it's not used from Windows. And yes, the Code of the day is still required.

Thanks for the suggestions Cheese.

Unfortunately, the IT dept are not going to be of much help here. Safeboot was a private purchase. We also have no agreements with McAfee for support, as we don't appear to use any of their products. The helpdesk have no experience with encryption software as no-one outside of IT has this type of software installed.

The person I spoke to at Safeboot was Simon Hunt, their Chief Technology Officer. He told me that without the recovery disk there was nothing I could do. Perhaps I caught him at a bad time and was given the 'easy' answer? As I'm still here, you might conclude that I haven't given up hope yet - despite the official verdict.

As I mentioned earlier, I did come across references to this 'SafeTech' recovery application, but without the password required to run it, I am no closer to finding a solution. If you have any suggestions on how I might obtain this password, then please feel free to point me in the right direction.

PS - You are correct, $350m. I mixed my $/£ signs up and did an unnecessary currency conversion.

Thanks for the information Tyorty, but unfortunately my problem relates to a different version of SafeBoot.

A few years ago, Control Break decided to enter the 'consumer encryption' market and launched a product known as SafeBoot Solo. Priced at around $100, they sold many copies. The program was based on the same source code as the enterprise version, but most of the features you mention, were stripped out of it.

About a year after its launch, Control Break pulled-the-plug and stopped selling Solo. Some speculate that Solo was pulled because it was damaging sales of its enterprise product. The official line is that supporting the product became too costly and the whole exercise was just an experiment.

Ah, yes, if it was a private purchase, then unfortunately, there isn't much that can be done to be honest. And I am familiar with Simon

Are you saying Cheese, that recovery of a corrupt SafeBoot disk depends on whose chequebook was used to buy it?

I thought I knew Simon as well, but was a little disappointed with his reply of "sorry, you're fcuked".

If you're saying that a solution to this problem exists, but is only available to enterprise customers, then please state this in your reply.

You are correct, it is only available to enterprise customers.

Whoa there Tiger! being toasted or not (I refuse to swear in public) has nothing to do with the purchase - simply, there are two places the keys are stored, one is on the disk protected with your password (and lost now because of the rubbish defrag tool moving things it should not), and one in the recovery pack which the OP has lost.

don't chastise me because a security product is doing EXACTLY what it's designed to do - prevent someone who does not have a legal key from getting access to the data. The enterprise tool mentioned replaces the OP's recovery disk - all the recovery data is stored up in a central server. Obviously the "solo" version doenst have this feature, so sure, he can get a copy of the enterprise stuff, but it's not going to help him without his individual key.

shame on you sb2k!

You are out of order stating that.

We do not know what happened, other people use encryption and have no problems.

If you properly read the above comments you will see that I made no such accusation. Rightly or wrongly, it was suggested that SafeBoot had a tool to recover a screwed up SafeBoot disk - and I was being denied this tool because you were unlikely to make any more money from me.







The key selling point to the enterprise version of SafeBoot, is that security is centrally managed (i.e. fully under IT's control). The suggestion that every time a user's password needs to be reset, someone has to phone SafeBoot support to obtain the "code-of-the-day" is simply ludicrous. If SafeBoot ceased to trade, the customer would not be able to obtain the code-of-the-day and would lose their data. Nobody in their right mind would buy a "security product" that puts the company's data at such risk.

I seem to recall from a few years ago that there were a lot of accusations that you were decrypting your customers' hard drives (via a backdoor) for various authorities - and charging a hefty fee. In fact, at one point it was claimed that you were making more money from offering this service than you were from selling the product.

Given your track-record, I'm surprised anyone's still buying your product.