Toshiba MK1652GSX Problem

[buster80]

Images 100% perfect, came out an HP Laptop

Recovery partition looks ok but system partition only raw, no file structure using all the main ones R-stud,GDB,UFS

Im thinking security encryption software, customer says no

any ideas

[ici_lemmy]

Use entropy to check encryption

[buster80]

Use entropy to check encryption

im googling

[Vulcan]

@buster80: A few comments...

came out an HP Laptop

FYI HP did bundle encryption s/w (SafeBoot, I think) with their laptops, at least for a while (though that doesn't prove whether this was in use in your case, of course). As ici_lemmy says, looking at the entropy of the "filesystem" gives a hint...

I would also look at the MBR and following few sectors (it's usually a special MBR for SafeBoot or other "full disk encryption" systems) - unless the customer has overwitten the MBR (and perhaos following sectors) during their "attempts" to fix the problem before you got involved. Therefore IMHO it is vital for the customer to give you a full and exact history of what happened, and what they did in response so far.

[buster80]

Thats helpful Vulcan, client said it just chucked it and I.T had a quick look before passing it on.

No secrets or anomalies although I'm skeptical as its very strange

cheers for that reply , going to open it up in winhex and post a screenshot

[ici_lemmy]

With winhex, you can also do "Analysis disk" (F2)... It will read all sectors and if a the graph is flat --> encryption

[buster80]

nice, thats handy

[harddrivespecialist]

HP does have security software which encrypts user partition.

Working right now on a drive with such encryption.

Anyone have suggestions or hints?