Doing a consent search on a Toshiba Satellite laptop. Booted the machine and was asked for BIOS password. Owner said the machine is not pw protected. I popped the CMOS battery out and got around that. Now I am asked for a HDD pw. The pw field is already filled out with *s. I cant access the BIOS, it goes right to the HDD pw screen.
Called the owner again and he said nothing is pw protected. My forensic machine doesn't recognize the drive either.
I did some searching and found several posts about people saying one day they booted their machine and was asked for a HDD password where it didnt exist previously.
Has anybody else ever encountered this or is the bad guy just playing dumb ?
Thanks in advance.
Found this a while ago as some possible workarounds.
http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=5093
There might be some additional drivers needed.
Have seen my fair share of quirky machine behavior (not this specifically that I can think of) so its certainly possible.
If it's an ATA password, you will have to remove the password with a system like PC-3000 UDMA.
As for the user not knowing about it, I can't see how this is possible except if the user launched a Secure Erase operation before handing you the laptop. When a Secure Erase operation is initiated, an ATA password is set on the hard drive preventing the user from reading/writing data until the erase process is completed.
Another possibility is that the HD is not ATA password protected, but is using a full disk encryption (PGP WDE or TrueCrypt).