"Wanna" ransomware outbreak. Please see this Sophos article sophos.com/kb/126733 for advice on how to protect your organization. Immediate action recommended.
Before the recovery key is sent to the defined key backup location the key is backed up locally. In the event the key fails to be sent to the share (perhaps due to an invalid path or the computer is off the network), the local backup location will need to be known.
Known to apply to the following Sophos product(s) and version(s) SafeGuard Easy 22.214.171.124SafeGuard Easy 5.50.1SafeGuard Easy 5.50.8SafeGuard Easy 5.60.0SafeGuard Easy 5.60.1SafeGuard Easy 6.0Sophos Disk Encryption 5.61.0SafeGuard Device Encryption 6.0SafeGuard Device Encryption 7.0SafeGuard Device Encryption 6.10.0
The recovery key is not generated until after the first restart, before the encryption process beings. Until then, the key is sent to the key backup location (as per screenshots).
There will be two files: an .xml and a .bkn file. Back up both of these files. The .xml is the recovery key backup and the .bkn is the MBR backup.
If the files are not present in the locations displayed below, it is possible they will be in the folder \savedbak\
C:\Documents and Settings\All users\Application Data\Utimaco\Safeguard Enterprise\LocalCache\gdm\newbak\
C:\Program Data\Utimaco\SafeGuard Enterprise\LocalCache\gdm\newbak\
C:\Program Data\Utimaco\SafeGuard Enterprise\LocalCache\gdm\savedbak\
Every comment submitted here is read (by a human) but we do not reply to specific technical questions. If you need technical support please post a question to our community. Alternatively for licensed products open a support ticket.