Stolen Laptop

Hi

Am I right in thinking that anyone with the knowledge will get into a PC if they have physical access to the machine? A moderator on a forum I use has had her laptop stolen and thinks it will be protected because she "used an administrator coding on my computer to get it to operate so without that information, it is not accessible to anyone."

In other words, it was password protected before it even booted into windows. I've not heard of this, but would be interested to hear what the opinion is on its data accessibility. Could someone not just remove the hard drive (albeit a laptop hdd) and connect it to their own laptop?

The question is did she have the hard drive actually encrypted. If not then the typical password protection scheme will fail quickly. Even then, they can reset any bios password, wipe the drive and have a shiny new laptop to use.

No, the drive wasn't even containing an encrypted drive for confidential stuff unfortunately. She doesn't have admin permissions on this forum so her details are of limited use, but of course I'm concerned for her other personal items etc. I just wanted to confirm what I thought was true - anyone with physical access can get round a password protected system, even if it asks for the pass before even booting up.

Quote:

---

Originally Posted by Moira

I just wanted to confirm what I thought was true - anyone with physical access can get round a password protected system, even if it asks for the pass before even booting up.

---

Consider it confirmed. It sounds like she has used a bios boot password. This can be circumvented by removing the bios battery for a while and then putting it back. This resets the bios settings (and any password that was was set in the bios).

The only way to truly protect your data is to properly encrypt the data or the drive that it is on with a strong encryption scheme.

OK, thanks for the help. Much appreciated though not very good news dammit :(

Quote:

---

Originally Posted by omin

Consider it confirmed. It sounds like she has used a bios boot password. This can be circumvented by removing the bios battery for a while and then putting it back. This resets the bios settings (and any password that was was set in the bios).

---

Or just remove the drive physically and put it as a slave in another machine. All files are easily read there.
Do note that some laptop brands store the BIOS password in EEPROM. You can remove the battery for 10 years and the BIOS password would still be there.

Quote:

---

The only way to truly protect your data is to properly encrypt the data or the drive that it is on with a strong encryption scheme.

---

Fully agreed.

http://www.heise.de/ct/english/05/08/172/

Hello Moira, good to see that you have returned :)

This is a subject I have looked into over the years and I cannot really give you anything definitive without knowing the make and model of your friend's laptop.

1. BIOS password: This is something you have to enter before it will load the operating system. You can normally circumvent it by removing the battery or just flashing the BIOS from a floppy disk. It protects the machine, rather than the drives.

2. Administrator password........... just a fancy BIOS password.

3. Hard Drive password............. this is a difficult one, as it lives in a hidden area of the HDD or even on its own chip?

Some BIOS and drive passwords live on an EEPROM chip (frequently a 24C) and that makes them invulnerable to removing the power supply (battery).

I would guess that whomsoever stole the laptop merely wants to convert it into drugs? so it probably isn't that much of an issue, as they don't want the data?

:)

I was a bit intrigued by the Eeprom issue, not having ever had it come up personally. There were a few sites that claimed the only method around that was the old soldering iron and a replacement chip. I saw some others mention using ultraviolet to clear the password. Others claimed you could send it to them and they would fix it for you (providing you proved legitimate ownership) for a fee.

Ah well, unless she had some kind of EEPROM chip, which I doubt from what she says, we'll just have to hope for the best and she can cancel her cards and other places she wouldn't want anyone else logging in as her. It sounds like an Administrator password, and it must be in the BIOS because she says it appears before she boot up.

Thank you for all the help.

Quote:

---

Originally Posted by isildur

I was a bit intrigued by the Eeprom issue, not having ever had it come up personally. There were a few sites that claimed the only method around that was the old soldering iron and a replacement chip. I saw some others mention using ultraviolet to clear the password. Others claimed you could send it to them and they would fix it for you (providing you proved legitimate ownership) for a fee.

---

About 10 years ago I was a certified Compaq and Toshiba service engineer working for a repairshop. Some laptop models did have those eeprom passwords, even back then. IIRC for certain Toshiba models you needed to have a special connector, attach it to the printer port, turn the laptop on while holding F2 and the bios password would be cleared. Taking the batteries out really didn't work.

UV light erases 'regular' eproms not eeproms. Soldering the chip off will of course work but since it's all SMD you would need special equipment. One little trick I learned while working for a modem company was to temporarily short the Data-OUT to ground (it used a serial data interface) of the eeprom and turn it on. That would effectively erase it.

This was a Toshiba laptop actually ....so it sounds as if it might be safer than some. But all this still doesn't stop you just removing the hard drive and attaching it to a similar machine.

Very true indeed...

Have you reported it's serial number to Toshiba?
Again IIRC they keep an eye out if that serial pops up somewhere (perhaps to get the password removed?).

Back then we had a situation like that.. Some guy came in, gave us a real phony story about loosing the password.
If he just said he forgot it we would never had it checked. But we didn't trust it so we called Toshiba.. Wasn't reported..
Hmm.. Right.. Let's just erase the password and see what's on it..
Hey, some word documents.. Hmm.. Letters, signed with a different name then the guy that brought it in..
Just for the hell of it we phoned the person that signed the letters..
Guess what? The poor sap had his house cleared by some burglars not to long ago..
Cops came by to pick up the laptop and pretended to be us to "return" it.
As soon as he took hold of it he was arrested on the spot :D

As far as I gather the serial number and the theft has been reported, though the victim doesn't expect to see it again.

Good example SirDice, amazing how complacency can trip people up. For once, justice was done :) if he couldn't remove the hard drive or sell the laptop, he shouldn't have stolen it!