I've just run into my first locked hard drive, which refused to do anything once it had been removed from a HP Elitebook laptop.
I was able to get the system admin to tell me the password, which allowed me to image the drive using a Helix CD in the laptop.
However, I've come to examine the image (acquired using ewfacquire), and found that the first 63 sectors of the drive are missing, and that the first sector is the start of the partition. I've manually added the partition using EnCase, and all the data appears to be there, but I'm curious if anyone else has had this happen to them.
Thanks in advance
I imaged the drive again this morning, and it seemed to have picked up the 63 sectors this time. I can only assume I specified the volume instead of the entire drive when I was running ewfacquire.