Use SmartWIM to capture an encrypted hard drive?

[Rudedog_45]

We're currently evaluating the Smart Deploy suite and one thing of interest is SmartWIM. I've been asked to find a way to image a laptop hard drive that has been encrypted using McAfee's Endpoint Encryption software and doing research it appears to be possible. If I boot the laptop using McAfee's BartPE environment, apply the decryption key, and build in network access, in theory I should be able to start up SmartWIM and capture the C: drive and dump the resulting WIM to the network. Does that sound plausible? Will SmartWIM function within a BartPE environment? Thanks!

[Erik]

We're currently evaluating the Smart Deploy suite and one thing of interest is SmartWIM. I've been asked to find a way to image a laptop hard drive that has been encrypted using McAfee's Endpoint Encryption software and doing research it appears to be possible. If I boot the laptop using McAfee's BartPE environment, apply the decryption key, and build in network access, in theory I should be able to start up SmartWIM and capture the C: drive and dump the resulting WIM to the network. Does that sound plausible? Will SmartWIM function within a BartPE environment? Thanks!

Assuming the boot environment will unlock the encrypted drive you should be able to use the SmartWIM components to capture it. You will need to add SmartWIM.dll to your boot media and register it. Once you register it you can use the SmartWIM.vbs that is provided in the SmartDeploy programs to specify commands such as capture and apply.

[Rudedog_45]

Yes! I was able to get this to work. I had to modify the BartPE environment to be able to recognize VBS files. That was done with a simple plugin. I dumped the WIM file to the network and was able to view the contents with 7-zip in a browser window. Cool!