Hp Protect tools plus corrupt bootloader = agony

[Atomdesign]

A client brought in his laptop a few days back saying it wouldn't start up anymore. I took a look..

When turning on the laptop, I am presented with a HP login screen requesting a fingerprint or password. This password is known, we type it in and get a windows error stating that the bootloader is corrupt.

I figured this would be easy enough - simply repair the bootloader. I booted off of the windows 8 disk and tried startup repair. Startup repair failed, because it could not access the drive the OS is installed on.

I decide to look up what the HP login screen post-bios is all about. It turns out HP Protect Tools was used to encrypt the partition the OS and my clients (important!) data is on. I later found out that messing with the bootloader on a drive encrypted with HP's software can mess things up further, so I'm glad in a way that the windows DVD repair options didn't function.

I searched online for ways to recover the data and found a way to perhaps rescue the files here:
ftp://ftp.hp.com/ftp1/pub/caps-softpaq/TCE&Q/
However, this method requires the backup encryption key (typcially saved to usb) to work.

Now here comes the fun stuff. The guy this laptop belongs was not aware that his drive was encrypted and didn't even know it was installed.. His laptop was originally installed at his companies main office, so we turned there to get the key file required to unlock the files on the drive. They don't have the backup encryption key. Brilliant.

Oh, did I mention that there is no backup of the laptops data anywhere? Of course there isnt.

My options for data retrieval are, as far as I can tell:

1. Somehow fix the bootloader without ruining the encryption

HP Protect Tools was the software used to encrypt the drive, which I believe is a modification of Winmagic Data Security. It actually has the winmagic logo visible when you are requested the password post-bios.
Winmagic Data Security installs a 'Winmagic Securedoc bootloader' over the normal bootloader. I found a guide explaining how to grant windows itself access to the bootloader in the link below, but I cant get into this console hitting F10:
Resolving an MBR error Message - Tulane ISO Wiki

2. Find the backup key somewhere. hah.

3. Send the drive to a data recovery company able to deal with encrypted files.
The one I called said they needed a backup key along with the drive. heh.

4. Decrypt the drive myself. Anyone know where I can find a supercomputer and a copy of some NSA decryption software?

5. consider files lost.

I think the option with the best odds of succeeding is option 1. The linked guide claims it is possible. Does anyone know how I might access the console on the HP version of this software? Any tips other than 'Data gone, gbye'?

Note: I did already clone the drive to secure its original state.

 

[GokAy]

Any settings in BIOS for this HP Protect Tools?
Would a Live Linux see the data? You can try Linux Mint MATE for this purpose.

 

[Atomdesign]

I did check out the BIOS, had a bit of hope when I saw a 'Save/Restore MBR of the system Hard Drive' option, but sadly this only prompts you for MBR restoration when the MBR is changed. No prompt so far.

Boot mode is on legacy, SecureBoot is disabled. I cant find anything related to protect tools, other than the fact that the default user in BIOS is a protect tools user. Logging in as this user gives me options related to protect tools itself.

Booting a linux live cd nets me access to the SYSTEM and TOOLS partitions, but the encrypted partition does not show (at least not in the file browser)

 

[GokAy]

See if it is mounted.

"parted -l" (or "fdisk -l") maybe. For Ubuntu you'll need to use "sudo".

"df" will show what is mounted - may or may not be what you're looking for. I prefer "df -hT" (see "man df" for details).
"ls" on (almost) anything listed will show lower levels - which can may be able to "cd" into. See the relevant manpages.

Try to mount if not:
mount -t ntfs /dev/sda2 /mnt/windows -o ro

sda2: you should get correct one from partition list

 

[Atomdesign]

Excuse my slow reply, I finally got around to following your steps, GokAy. When trying to mount the partition in a terminal with my linux live CD I get:

NTFS signature is missing.
Failed to mount '/dev/sdb2' : Invalid argument
The device '/dev/db2' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a partition ... etc etc

I'm certain I have the correct partition selected in my command

 

[GokAy]

Ok, I guess encryption makes it impossible. I was hoping drive would act unencrypted after BIOS password.

Tried Win7 repair disk yet? maybe you can see the data from command prompt

 

[Atomdesign]

I have tried the repair disk before, it wont see the files either I'm afraid. Tried Easeus data recovery and Photorec too, they will only recover a few really big files with no usable content in them.
I'm sending the disk t a data recovery company now. I doubt they can help, but we'll see.