Hi, I think I need you advice )
I'm triing to make an image of a Lenovo T400's harddrive.
I tried with FTK (2.3), but after logging in with user password to the Lenovo and Vista account as a local administrator, I still don't see the physical drive.
EnCase will not be useful because of the standard Lenovo encryption, Helix just has as an error message.
Any advices? )
If you're logged in, can't you use FTK Imager 2.7 to perform a live acquisition?
What is "standard" Lenovo encryption? I've owned several Lenovo's and haven't seen any encryption that I haven't installed myself.
I used FTK 2.3 (under Vista), but I did not see the physical drives.
Standard Lenovo encryption is Power On Password and Hard Drive Password.
Did you run FTK-I as an Administrator? If you didn't under Vista, it is likely that you won't see any physical drives. I've started FTK many times on my Vista box, only to realize that when I go to select the physical drive to image the list is entirely blank. Close it out, restart as Admin took care of it.
Hopefully, your problem is as simple as that.
Chris
Yes, I was a local administrator in Vista, and the physical drive list was empty.
The problem is now sloved the power-on and HDD passwords are disabled in BIOS.