97 replies to this topic

[mbushnell]

Hey m3fan,
I got the build to go through, and it boots. This is great, thanks for your assistance. I am not sure if it is working or not though.
I get an icon on the desktop, and when I Run it, it brings up the normal windows that gives the option to look for the encrypted drive etc. I then select Browse, and choose the "c" drive and it says I must format the drive to use it. This drive is a working encrypted drive but I am just not sure if all is working.

[homes32]

Hey m3fan,
I got the build to go through, and it boots. This is great, thanks for your assistance. I am not sure if it is working or not though.
I get an icon on the desktop, and when I Run it, it brings up the normal windows that gives the option to look for the encrypted drive etc. I then select Browse, and choose the "c" drive and it says I must format the drive to use it. This drive is a working encrypted drive but I am just not sure if all is working.

did you try this?

[mbushnell]

homes32,
thank you for getting back to me. The weird thing is I cannot find the ccore32.sys file. I have a cccore32.dll and the rest of the files, but for some reason I cannot find that one. Can you tell me where I would find it?

[m3fan]

OK, here is the disclaimer from their driver. If you guys think this is OK for me to post the whole script, i'll do it.

Check Point Full Disk Encryption - Encryption Filter Driver
This customer specific bootable CD-ROM allows use with Full Disk Encryption level installations for encrypted computers.
This Plugin is provided as is and is not supported by Check Point Software Tech Ltd.
Check Point Software Tech Ltd gives no warranty for using the plugin or any created image or CD-ROM from this information.
CHECK POINT SOFTWARE LTD DOES NOT LICENSE USING BARTPE OR MICROSOFT WINDOWS. USE WITHOUT APPROPRIATE LICENSING IS A VIOLATION OF MICROSOFT, BARTPE AND CHECK POINT LICENSING.

Edited by m3fan, 23 November 2011 - 03:56 PM.

[mbushnell]

Never mind on the ccore32.sys file, I found it. I am trying your recommendation now. Also as a side note, homes32, the avira script you made needs to be changed, the download links for the app and updates has changed. Here are the corrections to the script with the links just in case you want them.

%DownloadProgramURL%=http://personal.avira-update.com/package/wks_avira/win32/en/pecl/avira_antivir_personal_en.zip
%DownloadUpdateURL%=http://dl.antivir.de/package/fusebundle/win32/int/vdf_fusebundle.zip
Thanks again and I will update you guys when I have this tested out, and thanks in advance for all of your help.

[mbushnell]

okay guys, I have followed the above and I at least see the drive now, but when I click on it to initialize it I get the error "unable to initialize"
Any ideas?

[homes32]

%DownloadProgramURL%=http://personal.avira-update.com/package/wks_avira/win32/en/pecl/avira_antivir_personal_en.zip
%DownloadUpdateURL%=http://dl.antivir.de/package/fusebundle/win32/int/vdf_fusebundle.zip

thats for the 2012 release...I'm still having some issues with services not starting (for updater) with 2012 and the current script version...also they switched to VC++2010 so I have to updated the dependincies.
stay tunned for an update on that.

[rmgross78]

Great script but having a small issue. When I launch the DMU within PE I see the C: drive and it is listed as being protected by FDE, now normally when I click the drive it will prompt me for the username and password to unlock the drive, but instead I get a message saying "Unable to find full disk encryption protected volume(s) on this disk"

anyone have any ideas?

[m3fan]

Great script but having a small issue. When I launch the DMU within PE I see the C: drive and it is listed as being protected by FDE, now normally when I click the drive it will prompt me for the username and password to unlock the drive, but instead I get a message saying "Unable to find full disk encryption protected volume(s) on this disk"

anyone have any ideas?

That might be a problem with the version of FDE Dynamic mount that you are using. I think i had an issue with the 2.0 but 1.4 works fine for me. Also make sure you have all the files in place, especially prot_2k.sys and ccore32.sys. What kind of PE are you building anyways? I have not tested 64bit but in 32 works fine for me,

[rmgross78]

Thanks for the quick response!

I thought about that as well, and I grabbed the same DMU files and prot_2k file that I used on my older bartPE disk to make sure I wasnt mixing up the version. I have verified the files are in the proper places and they are being copied into the RAM drives Windowssystem32drivers folder. This is on the 32bit windows 7.

how do I verifiy which version of the DMU I have?

[rmgross78]

NVM, found out I was using the 2.0. downloading the 1.4 now and will try again.

[rmgross78]

ok, 1.4 same issue..... I was all excited too.....

[Wonko the Sane]

Anything useful here?
https://forums.check...messageID=28578


Wonko

[m3fan]

Works fine with FDE 7.4 HFA3 and 7.2

[rmgross78]

I'll play around with it some more but I either get the nice BSOD of 5001146 which normally means the prot_2k.sys file doesnt match the version of encryption or I get the message "Unable to find full disk encryption protected volume(s) on this disk"

[rmgross78]

ok after playing around with version 1.4 up to and including 2.0 I have determined it just will not work for me, I have followed everything instruction listed but continue to get the "Unable to find full disk encryption protected volume(s) on this disk" when trying to unlock the drive. when I pull down the REC file from our production server and try to use that to unlock the drive the system blue screens with a stop code of 000008E, and if I try a different Prot_2k.sys file it will blue screen with the stop code if 5001146. I have spent over 2 hours talking to Checkpoint about this but they were next to useless.

anyone have any other ideas I could try before I go back to BartPE?

[mbushnell]

Homes32 and m3fan I have done as you suggested and I still get either no drives listed, or it lists a drive and when I click on it and should see the screen to input the user and password a window comes up saying it needs to format the hard drive. With that said, how do I find out which version I am using? Off of my own machine which is encrypted I get this info:
R73
v-7.6.145
7.4 HFA2
Build 1601

All of that really makes no sense to me. But I guess I am using maybe two different versions. Please let me know what you think.
Thanks,
Matt

[m3fan]

Where are you clicking? Don't click on the "Browse" button. You need to click on the actual drive in the list.

[rmgross78]

If asking me, I click on the drive itself. Browse is only used when you are using the recovery key.

[mbushnell]

Yes, I too only click on the drive, and thats only if it shows up. It does not always show up, but when I click on it, and expect to see the login screem for it, it simply comes up and tell me it needs to format that drive.
How do I tell what version I am using? Maybe that is my issue.

[mbushnell]

see if this helps out.
you will have to encode the files into the script.

• place the .script in your Apps folder
• open winbuilder and go the the script.
• press the little button that looks like a wrench (above the small green "play" button)
• click on the attachments tab
• click the "Add" button on the right
• add Prot_2k.sys and ccore32.sys to the drivers folder
• add all other files (FDE_Dyn_Disk.exe, etc.) to the program folder

regards,
Homes32

So how do I tell it to copy those files to those folders? I do not see an option for that. I see where I can simply "add" the files, but it does not give me an option to choose where they are saved to. Can I just manually copy the files in to those folders, or does it need to package them a certain way?

[homes32]

when you are in Attachemnts view you need to click on the folder you want to add the files to and then press the add files button

[rmgross78]

I have tried adding the files both by the method you have listed above and by injecting them directly into the WIM using DISM and even trying to convert the BartPE plugin into the windows 7 PE format, all ended with the same result. I am running Version 7.6.150 R73 of pointsec, I have wasted over 2 hours on the phone with pointsec, at this point I think I am just doomed to have to have 2 different versions of a bootable recovery media.

[mbushnell]

rmgross78,
I wanted to ask you if you are using Win7PE_SE or Win7PE? The reason being is I finally realized I was using the latter and when I started using the SE version the scripts started working properly. Also, you might want to contact m3fan and ask him for his script if you have not already done so. If you need I can try and get the script he sent me, and give you some directions as to what I did, but you will have to supply your own files. I can try and give you the version numbers of the files I have that work. I know there are allot of things I have here, but tell me what I can do to help. I figure I got allot of help from homes32 and m3fan and I want to do what I can to help the next person. Giving it forward so to speak.

[rmgross78]

I am using the Win7PE_SE, as for M3Fan, are you talking about the script he has posted on page 1? If so I have already tried that one as well. Its really strange as the files I am using work fine when I inject them into the BartPE, meaning the source files are both pulled from the same CD of checkpoint, so I know they are the correct file versions.