Performing Data Recovery

Check Point Full Disk Encryption Recovery

If the operating system does not start on a client computer due to system failure, Check Point Full Disk Encryption offers these recovery options:

Full Recovery with Recovery Media

Client computers send recovery files to the Endpoint Security Management Server so that you can create recovery media if necessary.

After the recovery, the files are restored as decrypted, like they were before the Full Disk Encryption installation, and the operating system can run without the Pre-boot.

Full recovery with recovery media decrypts the failed disk and recovers the data. This takes more time than Full Disk Encryption Drive Slaving Utility and Dynamic Mount Utility that let you access data quickly.

Recovery Media:

• Is a snapshot of a subset of the Full Disk Encryption database on the client.

• Contains only the data required to do the recovery.

• Updates if more volumes are encrypted or decrypted.

• Removes only encryption from the disk and boot protection.

• Does not remove Windows components.

• Restores the original boot procedure.

Users must authenticate to the recovery media with a username and password. These are the options for the credentials to use:

• Using SmartEndpoint - Users that are assigned to the computer and have the Allow use of recovery media permission can authenticate with their regular username and password. In SmartEndpoint, go to the OneCheck User Settings Rule > Advanced > Default logon settings.

• When you create the recovery media, you can create a temporary user who can authenticate to it. A user who has the credentials can authenticate to that recovery media. Users do not require Allow use of recovery media permission to use the recovery media. Smart Card users must use this option for recovery.

To perform full recovery with recovery media

1. Go to Asset Management > Organization > Computers.

2. From the top toolbar, click and select Remote Help & Recovery > Recovery > Full Disk Encryption Recovery.

3. Search for the computer which you want to decrypt.

   The OS Name and OS version of the computer are displayed.

4. User List - This list shows the users who have permission to use recovery media for the computer. There must be at least two users on the list to perform recovery.

   • If there are two users or more on the list, continue to the next step.

   • If there are less than two users on the list:

     1. Click the + sign to create a temporary user or temporary users who can use the recovery media.

     2. In the window that opens add a username and a password that the users use to access the file.

5. Download the recovery file.

6. Create the recovery media:

   Step	Description
   1	On the Endpoint Security client, go to folder: C:\Program Files(x86)\CheckPoint\Endpoint Security\Full Disk Encryption\
   2	Double-click UseRec.exe to start the external recovery media tool.
   3	Follow instructions in the tool to create the recovery media.

Full Disk Encryption Drive Slaving Utility

Use this to access specified files and folders on the failed, encrypted disk that is connected from a different "host" system.

The Drive Slaving Utility is hardware independent.

Full Disk Encryption Drive Slaving Utility replaces older versions of Full Disk Encryption drive slaving functionality, and supports R73 and all E80.x versions. You can use the Full Disk Encryption Drive Slaving Utility instead of disk recovery.

To use the Drive Slaving Utility:

1. On a computer with Check Point Full Disk Encryption installed, run this command in Windows Command Prompt to start the Full Disk Encryption Drive Slaving Utility.

   <DISK:>\Program files(x86)\CheckPoint\Endpoint Security\Full Disk Encryption\fde_drive_slaving.exe

   The Full Disk Encryption - Drive Slaving window opens.

   Note:

   To unlock a protected USB connected hard disk drive, you must first start the Drive Slaving Utility, and then connect the disk drive.

2. Select a Full Disk Encryption protected disk to unlock.

   The Unlock volume(s) authentication window opens.

3. Enter User account name and Password.

4. Click OK.

After successful authentication, use Windows Explorer to access the disk drive. If you fail to access the locked disk drive, use the Full Disk Encryption recovery file, then run the Drive Slaving Utility again.