Cloning an encrypted HDD

[evilsatan]

I have a client who needs their HDD cloned from their work laptop as the drive is dying. The drive is encrypted with Safeboot. I have the encryption password and the Windows XP user password but no access to an administrator account, the user is not able to access physical or logical drives.

I have cloned the drive using both Norton Ghost and CloneZilla both with the same result. The initial safeboot screen appears, I enter the password then it goes to a screen with a few coloured pixels and a flashing cursor, it will not go any further. With both clones I set it to RAW sector-by-sector and CloneZilla clones the MBR and all data from sector 0 onwards. I am beginning to think that safeboot may link the deviceID or serial number of the HDD so that a clone is not possible. Both the source and target drive are the same manufacturer and capacity but not the exact same model.

So I thought if I boot the HDD to XP so that the data was decrypted I could run driveimage XML to backup the drive as it supports hot backup. But the problem is this user does not have the privilege to access the drives so Driveimage XML displays no drives to backup.

Can anyone think of any steps I can take from here to achieve a 1:1 clone? This is more of a project now than anything else, if I cannot find a way then I will tell them to take it to their company IT team who can permanently decrypt the drive then back it up.

Command prompt has been disabled for this user so I cannot use that to try and gain admin or system access.

Cheers

[Zippeyrude]

i cant help you on this but bitlocker links to the chip serial number for the key (TPM - trusted platform module).

check if safeboot has a similar requirement.

[evilsatan]

I assumed as much, I don't want to mess around gaining admin privileges unless it is temporary as their IT team might not like them having gained admin access and the user might inadvertently mess up a setting for their work VPN etc.

I had thought of logging in so the data was decrypted then backup over network but I don't know if this is possible. The problem is the decryption stage must be at boot so I cannot decrypt then boot to a liveCD to backup the data. I don't think I can permanently decrypt using their safeboot password and nor would I want to as it would infringe the DPA for the client.

I think this is futile but any ideas would be appreciated, it has been fun trying all these different methods but it is rather frustrating not being able to succeed.

[Zippeyrude]

can you not seek their consent to decrypt, image drive, restore, encrypt?

[evilsatan]

Unfortunately not, all work is to be done by their IT team. I will just hand it back to the client and tell them to drop it into the appropriate department when they are next at the offices, shame though.

[evilsatan]

My last bash at it was booting into Ubuntu, launching terminal and running a straightforward dd clone with no additional parameters and this gets me past the first encryption page, then Windows XP logo and loading bar comes up, then there is a BSOD

unmountable_boot_volume
0x000000ED

I can't boot from an XP CD to run chkdsk so I think this is an impossible job.

[Over Carl]

Kon boot to temporarily boot into admin?

[evilsatan]

Kon boot to temporarily boot into admin?

I will give it a try mate but not sure it will be able to access the appropriate part of windows prior to decrypting and the decryption is done at boot so I can't boot to the CD after that. Also not sure if administrator is used for the username.

Cheers

[evilsatan]

Kon-boot didn't work and nor will other bootable password tools

As far as I can see the only potential solutions are:
- To gain temporary admin access from within XP without the use of CMD (disabled) or accessing C: (disabled)
- To remove safeboot (4.2) from the boot screen on the cloned drive so I can then repair XP and run tools to gain admin access

There is a WinPE CD with Wintech/Safetech which could help but I cannot find the CD anywhere.

Just FYI this is more of a project now to see if the job is possible, I will be handing back the laptop for the client to take to the IT team next time they are at the offices.

[Zippeyrude]

doesnt hirens have WinPE or MiniXP?

[dibbler]

You can build a safeboot boot cd. This has to be done from the safeboot console as it needs the access codes for the laptops. It has a version of win pxe on it
I used to have work on laptops with safeboot on and tried alsorts of boot disk etc but never got in!

[evilsatan]

Hiren's has MiniXP but that is a standard version which will have no tools to decrypt safeboot. I don't think I have access to the safeboot console as I am not an admin user but will have a look just in case.