Jump to content
CCleaner Community Forums
sb2k

Hard disk now corrupt

Recommended Posts

Hi

 

I have a small problem. Ran Defraggler last night, now my PC won't boot up.

 

After a couple of hours Googling, I think I've found the cause of the problem. There are a couple of system files which should never be moved (http://support.microsoft.com/kb/227350) -

 

> Moving the following files (if present) can cause desktop problems:

>

> Safeboot.fs

> Safeboot.csv

> Safeboot.rsv

> Bootsec.doc

 

As the error message reads "Safeboot has been corrupted (error 92h)", I presume it relates to the safeboot.fs file referred to above. This message is shown before any attempt to load Windows.

 

Could somebody please tell me if it's possible to move this safeboot.fs file back to its original location?

Share this post


Link to post
Share on other sites

Can we just clear one thing up, is this Safeboot a laptop tracking software you have on it to prevent theft?

 

Or are you talking about the actual safeboot keys in the registry? You cannot boot into safe mode?

 

What operating system?

 

Were your virus/malware scans clean?

Share this post


Link to post
Share on other sites

Safeboot is an OTFE program written by CBI. McAfee recently bought them for $750m and claims to have an installed-base of over 5 million users. HP also offers it as an option on its range of laptops.

 

From what I can gather, Safeboot replaces the MBR with its own version. The Safeboot MBR loads the decryption driver which unlocks the drive and allows Windows to start up normally.

 

I am assuming that the modified MBR points to the physical location on the HDD where safeboot.fs is stored. As this file has been moved, the Safeboot MBR does not know where to find it.

 

My theory is that by moving the safeboot.fs file back to its original location, the Safeboot MBR will be able to see it again. However, this relies on -

 

a) It is possible to relocate a file to a specific location on the disk.

 

B) There is some way to debug the Safeboot MBR to see what address it expects to find the safeboot.fs file located at.

 

Any comments or suggestions on how I go about achieving this would be very welcome.

 

The machine is running Windows XP, and was virus-free a few days ago when last scanned.

Share this post


Link to post
Share on other sites

I am not sure if the safeboot files you mention will have been moved as they are windows files.

 

Your problem seems to be with the safeboot encryption program files.

 

What actual access at all have you got on the laptop at the moment?

 

Is there any error number given?

Share this post


Link to post
Share on other sites

The problem and error code are documented in the following article -

 

https://knowledge.mcafee.com/article/989/61...SAL_Public.html

 

Problem

 

When booting up a client machine with SafeBoot Device Encryption installed, you see the following error indicating that SafeBoot is corrupt:

 

SafeBoot is corrupt, Error 92H

 

Change or Cause

 

This is due to a corruption or relocation of the SafeBoot file system.

 

 

Their solution involves creating a bootable floppy and running their recovery application 'SafeTech'. However, what the article does not tell you is that you are required to enter a 4-digit password before it will do anything useful. This password is a hash of the current day, so to guess it you would need to enter up to 10,000 possible combinations before midnight - or the code will change to something else. I was hoping to find a less challenging solution.

 

By now, I'm sure you're wondering why I don't just contact Safeboot support for assistance. The problem here is that the line of Safeboot I have installed (i.e. Solo) was discontinued a few years ago. Up until a few months ago, there was a good chance that CBI would have provided some assistance. However, since being acquired by McAfee their support is only reachable via McAfee's general helpdesk - which is pretty impregnable even for support on its current range of products. So-far I have been unable to find anyone in McAfee who has even heard of Safeboot.

 

Hence my desire to work-out what Defraggler did to the disk and attempt to reverse it.

Share this post


Link to post
Share on other sites

Having just read up about it I can see the extent of your problem in accessing the computer.

 

The nearest I could get was an email address for encryption solutions where I believe you would have to cite the document number that relates to either Safeboot 4 or Safeboot 5.

 

ebssales*at*mcafee.com

 

I really don't know why Defraggler would move those files which are standard 'unmovable' windows files or even if it did.

 

Unfortunately I cannot see anyway around the encryption issue apart from trying McAfee, which as you already now, could be difficult.

Share this post


Link to post
Share on other sites

For other readers of this topic.

 

I would never Encrypt my hard drive as I don't work for CSIS, CIA, FBI MI5 nor Interpol so anything on my hard drive is not really very interesting except maybe I like to watch The Simpsons , BlackAdder and occasionally Keeping Up Appearances and Yes Minister.

 

I live by Murphy's Law where he rules supreme within the realm of the PC.

Share this post


Link to post
Share on other sites
I would never Encrypt my hard drive

 

 

That is your choice Kenny, this user has used encryption and has a serious problem.

 

He has asked for help with it, so please try to offer advice if you can, which may help towards a solution rather than just stating that you wouldn't encrypt your drive.

Share this post


Link to post
Share on other sites

YoKenny, my day-job involves databases and writing interfaces that exchange data with clients and suppliers. My company has allowed me to work-from-home a few days a week, so long as I can show that any data on my PC is secure. Hence the need for Safeboot.

 

I'm sorry, but I have neither the time nor energy to debate the merits of encryption with you right now.

 

 

Hazelnut, thanks for keeping this discussion on-topic. I also appreciate your suggestion of emailing encryption solutions. I will give that a go and see what develops.

 

 

 

I haven't been too diligent in my backups of late (I know :unsure: ), so I really don't want to fdisk the PC and start again. If I still haven't resolved this a week from now, I think I will have to buy a replacement HDD to reinstall XP onto - and hope that I can recover the disk at a later date.

 

If I find a solution, I will update this thread. If you're reading this months/years from now and I have not replied, then assume the worst - you will need to reformat your drive.

Share this post


Link to post
Share on other sites
YoKenny, my day-job involves databases and writing interfaces that exchange data with clients and suppliers. My company has allowed me to work-from-home a few days a week, so long as I can show that any data on my PC is secure. Hence the need for Safeboot.

I apologize.

 

I did not understand.

Share this post


Link to post
Share on other sites

Assuming the safeboot file was moved somewhere on the disk and the MBR doesn't know where it is you

may want to consider the following.

 

There are disk editors out there (i.e. Acronis Disk Director) or free ones which allow one to do a raw edit

of the disk track by track and sector by sector. The data could be displayed in raw mode or hex mode.

Thus, one starts at location zero where the MBR is at to find out where it thinks the disk drive sector location

is for the safeboot file. Then reading the directory structures, one locates the safeboot file and reads the

starting disk location of where it currently is at. Now that one knows the current location, one can modify

the MBR data entry with this new location so that when you save and exit it will now know were to go.

 

A Problem with the above method.

Because the drive is encrypted, the raw data that you see in the editor will also will be scrambled/encrypted

and perhaps the data too for the MBR. Hence the above method will not work for encrypted drives,

but only for those that don't have it which then makes the safeboot file problem not a problem since one

wouldn't have it installed if the disk wasn't encrypted.

 

Maybe another way is to,

a). bootup a second disk that has it's operating system encrypted with the same set of keys.

b ). since both the new bootable OS and the non-Bootable disk use the same set of keys, one could

(maybe) mount the non-bootable drive onto the good OS that was booted.

c). Since the same keys are used and maybe encrypted the same way, one could see all the files that

are important (i.e. company, personal files) and copy them off the mounted drive onto the good drive.

After this is done one could just unmount it since one has all the important data.

d). after doing this, one could just reformat the other bad drive or continue with the new one.

 

The above are some possible thoughts that may work, or the only recourse is the vendor to help out. :huh:

 

 

Note: Before doing any of the above, I would suggest imaging the bad drives data and saving it on another

drive. Do the playing around of the bad OS, and should it not work or you do something wrong, you'd still

have the copy of the original bad disk drive as a disk image which could be restored back to the drive

to keep playing around forever.

Share this post


Link to post
Share on other sites

I haven't heard anything from ebssales yet, but I did manage to find the email address of one of the developers of SafeBoot from alt.security.scramdisk. He replied quite promptly that without a file called SBCONFIG, I was up a stream without a paddle. This file contains the actual AES key required to decrypt the disk and is protected by the password you enter to logon to SafeBoot. Unfortunately there was a bug with SafeBoot at the time I bought it that caused the file to bloat to over 5MB, making it impossible to write to a 1.44MB floppy disk. When I installed the program and created the recovery disk, I basically created something that was completely useless.

 

Anyway, I think I can discount any useful assistance from SB/McAfee. I ordered a new Seagate drive today, so I can get my main PC back up and running. I also made a couple of experiments on this old Athlon XP PC (which was also running SBS) with some utilities from sysinternals.com. To cut a long story short, I screwed this PC up as well and have spent the last hour reinstalling XP. This is not one of my better weeks.

 

If anything positive came out of these experiments, it is confirmation that the safeboot.fs file is the one that doesn't like being moved. However, even with a copy of SBCONFIG, the recovery program failed to restore the drive to a working state.

 

I haven't given up trying to recover my data yet, but the Wikipedia entry on the MBR refers to it containing machine code - as opposed to a pointer to the next bootstrap file. In which case, I am definitely out of my league and should probably give up now.

 

I still have a bit of hair left, so I'll give it a few more days.

Share this post


Link to post
Share on other sites

Thanks for keeping us up to date with your ''progress''.

 

It wasn't good news to read that the recovery cd made at install was basically just a coaster. What a time to find that out.

 

I certainly wouldn't give up on it, with the persistance you seem to have you may just hit on something.

 

I would imagine that when you are all up and running again you will become the ''backup king of the computer world'' :)

 

Keep in touch with how you are going on. You never know someone may add to this thread with a pointer in the right direction.

Share this post


Link to post
Share on other sites

The 'Safeboot' the original poster is talking about is a piece of encyption software which makes it's own modified version of MBR.

 

If you read what the poster said here

From what I can gather, Safeboot replaces the MBR with its own version. The Safeboot MBR loads the decryption driver which unlocks the drive and allows Windows to start up normally.

 

I am assuming that the modified MBR points to the physical location on the HDD where safeboot.fs is stored. As this file has been moved, the Safeboot MBR does not know where to find it.

 

You can now see what a difficult situation he is in.

 

But thanks for the MBRfix you posted anyway. It may help users who have that problem

Share this post


Link to post
Share on other sites
The 'Safeboot' the original poster is talking about is a piece of encyption software which makes it's own modified version of MBR.

 

If you read what the poster said here

From what I can gather, Safeboot replaces the MBR with its own version. The Safeboot MBR loads the decryption driver which unlocks the drive and allows Windows to start up normally.

 

I am assuming that the modified MBR points to the physical location on the HDD where safeboot.fs is stored. As this file has been moved, the Safeboot MBR does not know where to find it.

 

You can now see what a difficult situation he is in.

 

But thanks for the MBRfix you posted anyway. It may help users who have that problem

 

Oh, you are wright not the same.

We had safeboot installed and wanted to use the disk again after the format. Changed MBR didn't allow to boot a disk, even with Windows partially installed on it (using bootable CD).

 

The problem sb2k has is serious indeed...

 

I remember in my company we sent to IT another corrupted disk (couldn't boot for some reason and data couldn't be resored using "standard" software).

IT department managed to get all the data (software from Safboot vendor?) and reinstall the system.

 

Thus, maybe if you can get the data back, fix MBR, reinstall the system and Safeboot if needed.

 

Sorry for confusion.

Share this post


Link to post
Share on other sites

@sb2k

 

You certainly *do* have a problem there. I wish you the best of luck in trying to fix it, but it looks like you might be out of luck, given the lack of available support.

 

But I do have some advice for the future: no doubt you will still need to use encryption (for your stated reasons), so why not use TrueCrypt ?

[ http://www.truecrypt.org/ ]

 

...This is widely respected open source freeware, and can be used in a number of ways, for example...

 

1) You can encrypt the entire hard disk (as you did with Safeboot)

 

2) You could reserve some space on your hard drive for a virtual encrypted disk

 

3) You can use it in "installed" or "portable" modes.

 

Being FOSS, it is still well maintained, the most recent update being July 8th.

 

[ Apologies if you already know all about it... ;) ]

 

-thm

Share this post


Link to post
Share on other sites

Hey SB! Sorry to hear about your week. My last three weeks have been very similar to yours. During my struggles, I came across a company and their software that may stand you in good stead right about now. They have two programs that might help you. One is free, and one is free to try. Go to http://www.dtidata.com/ and check out their data recovery software programs (which one depends on your OS) and also take a look at their NTFS Partition Repair Tool. I have read hat your issue is, but take a look at their write-up on their software before you decide it won't help you just based on the name.

 

I am not affiliated with them at all by the way. I am just a fellow floundering pc hobbyist. I called the company when I had a question and they were very nice and helpful, so I was impressed.

 

Good luck.

Share this post


Link to post
Share on other sites
I called the company when I had a question and they were very nice and helpful, so I was impressed.

You're lucky most just send a phone number to their tech in WhoKnowsWhereLand, or have you go to their support documentation. ;)

Share this post


Link to post
Share on other sites
Safeboot is an OTFE program written by CBI. McAfee recently bought them for $750m and claims to have an installed-base of over 5 million users. HP also offers it as an option on its range of laptops.

 

From what I can gather, Safeboot replaces the MBR with its own version. The Safeboot MBR loads the decryption driver which unlocks the drive and allows Windows to start up normally.

 

I am assuming that the modified MBR points to the physical location on the HDD where safeboot.fs is stored. As this file has been moved, the Safeboot MBR does not know where to find it.

 

My theory is that by moving the safeboot.fs file back to its original location, the Safeboot MBR will be able to see it again. However, this relies on -

 

a) It is possible to relocate a file to a specific location on the disk.

 

B) There is some way to debug the Safeboot MBR to see what address it expects to find the safeboot.fs file located at.

 

Any comments or suggestions on how I go about achieving this would be very welcome.

 

The machine is running Windows XP, and was virus-free a few days ago when last scanned.

350 million...

Share this post


Link to post
Share on other sites
Hi

 

I have a small problem. Ran Defraggler last night, now my PC won't boot up.

 

After a couple of hours Googling, I think I've found the cause of the problem. There are a couple of system files which should never be moved (http://support.microsoft.com/kb/227350) -

 

> Moving the following files (if present) can cause desktop problems:

>

> Safeboot.fs

> Safeboot.csv

> Safeboot.rsv

> Bootsec.doc

 

As the error message reads "Safeboot has been corrupted (error 92h)", I presume it relates to the safeboot.fs file referred to above. This message is shown before any attempt to load Windows.

 

Could somebody please tell me if it's possible to move this safeboot.fs file back to its original location?

In order to correct this issue, you will need to perform an emergency boot. Also, the MS defrag utility does not have this problem as those files are excluded by MS.

Share this post


Link to post
Share on other sites

Cheese I suggest you read all the thread.

 

He is /was using encryption. No such option as emergency boot available to him.

Share this post


Link to post
Share on other sites
Cheese I suggest you read all the thread.

 

He is /was using encryption. No such option as emergency boot available to him.

I know what he is using, and yes, for a 92H, there IS an "emergency boot" option, he need to talk to his IT department and find out who supports the Safeboot. They can call, get a "code of the day" and perform this and it will correct this, the reason the 92H came up is because he did use this utility, any third party utility, unless those files are excluded, will always bring up that particular error.

Share this post


Link to post
Share on other sites
The support for his version of safeboot is limited now as he said.
If his IT people still support it, they can do this, even with limited support from customer service. They need a Safetech disk, a code of the day, and if they know how to do the steps, it takes 10 min or so to get it back up and running.

 

I have had to deal with this software in my profession for close to 2 years, I am very familiar with how it works and what needs to be done

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

×