T42 won't boot-- can I recover Utimaco PrivateDisk data?

[bloodbox]

Hello,
I'm a newbie who's in dire need of help. I tried reading various FAQs and haven't made much progress.

I have a 4 yr. old T42 (2378-XXR) running Windows XP SP2. I use Utimaco Safeguard Privatedisk. At this point, I'd like to see if I can simply recover my private disk volume and some unencrypted data on the hard drive. I don't know if I have a memory problem, a power supply problem, a motherboard problem, or something else. The machine may have been subjected to a power surge a few weeks ago, though I wasn't there when it happened. The machine is out of warranty, but while in warranty it went dead and I sent it to IBM, who replaced the motherboard. I bought the machine as a refurb.

Here are the symptoms and what I've done so far.
The computer will not boot. The battery light comes on, as does the power light (the diagonal Z). I can hear the fan whirr and the hard drive spin up.
I cannot get into the IBM Access area. I have a Recovery CD that I made in 2005, but I guess it's useless if I can't get into IBM Access.
I tried removing the battery, powering down by holding the on/off button down, then starting up again. I tried booting into BIOS by holding down F1, and twice I was briefly able to get in and move through some optiosn. But then the computer freezes, the display starts to waver a bit, and then I can't control anything.

Two times while starting up I saw error message 210, and according to an IBM hardware manual, that's a keyboard error. I tried disconnecting the keyboard cable, but don't know how to start the machine without it, since the power switch doesn't seem to be independent of the keyboard. I also thought I could test the keyboard by using PC Doctor. I made a set of PC Doctor floppies and wanted to try booting from those (using an external USB floppy), but it didn't work. The machine didn't read from the floppy during the start up process, and I couldn't work in the BIOS environment to see if I could set it up to read from the floppy first. I don't know whether booting from a USB floppy is possible anyway.

I also connected the machine to an external monitor to see if there was just some problem with the internal video display, but so long as the computer didn't boot, it didn't show an image on the external monitor. However, on the rare occasions when I got the machine to boot, the built in LCD did show the IBM logo. And of course the built in LCD worked during the brief time I was in BIOS.

I wan't able to run Memtest from a floppy since I can't boot from a floppy (unless there's another way to do it.) I don't have any extra memory for this machine to test it.

Any help would be appreciated. I'm in a bind because my main backup was on a hard drive that just failed before this happened. I have some other piecemeal backups, but getting all the current data from the drive would be the best.

Mark Lewis

[sjthinkpader]

You may want to read thru Ultimaco's recovery instructions before proceeding further.

[bloodbox]

Utimaco is now owned by Sophos, and all I could find were articles on creating some type of recovery kernel if you're using Safeguard Disk Encryption 4.6.
http://www.sophos.com/support/knowledge ... 09327.html
http://www.sophos.com/support/knowledge ... 09265.html
http://www.sophos.com/support/knowledge ... 09363.html

I don't know if these work with Privatedisk or not. The Lenovo site still offers Privatedisk for download but states they don't support it. This is unfortunate since it came bundled with the T42 and was supported at the time. (I once called Utimaco and got assistance.) I may have a paper version of the original client security manual stored away somewhere.

A different approach: Assuming my hard drive is good, what further steps should I take to diagnose the machine? Maybe I can get it running with some new components, and as long as I don't clear the security chip, I could still decrypt my privatedisk.

[sjthinkpader]

Do a barebones test. Remove everything and confirm you have the no-memory beeps. Then insert one module and see if it will boot.

[bloodbox]

Before I logged on and saw your reply, I tried to boot into BIOS again. The machine had been sitting unplugged for several hours. I powered up and pressed F1. The machine worked-- for a time. While in the setup, I changed the settings so it would boot in the diagnostic mode, and I checked to see if the floppy with USB was enabled. (It was). I then plugged in my USB floppy, proceeded to restart from the setup menu, and loaded the first PC Doctor floppy. The machine ran through some kind of memory test (there's 512MB under the keyboard), and I saw the RAM numbers increase to around 568. Then it started reading the floppy and started loading PC Doctor. It made it through floppies #1 and #2, then the screen went dark. The floppy stopped running, so on a lark, I decided to put in #3 and then hit a key. It loaded, and I did the same for #4. But when that finished, nothing happened when I tried to load #5.

After that, I powered off and tried to start up again. I couldn't get into BIOS that time.

I then tried your memory test. I removed the DIMM module under the keyboard and restarted the machine. It beeped in this pattern: 1-3-3-1. Is that the "no memory" beep sequence? I then loaded the DIMM in the slot on the backside (in case the top slot was bad), but it still wouldn't boot. I then took it out and put it back under the keyboard, and it wouldn't boot.

Does the memory test in the diagnostic mode indicate the RAM is OK?

What's the next step?

[sjthinkpader]

The 1-3-3-1 beeps indicate that the computer recognized the absent of RAM. At this point I would try another stick of RAM.

[Brad]

I think your hard drive is working from what you describe. Your T42 on the other hand appears to have a motherboard problem. If you could repair your T42 or borrow another ThinkPad and recover your data you would be back in business.

Brad

[bloodbox]

If I find/borrow another T42 (or replace the motherboard on mine), do I set the passphrase on the security chip for the same one that I was using before, so I can access the virtual private disk?

[bloodbox]

Here's an update in case anyone ever has a similar problem.

The system board was indeed bad. I replaced it (with a board from a T42 model 2373) and added a long fan, since the new board had a hotter graphics chips (the ATI Mobility 9600). This is a time-consuming job, requiring a complete disassembly of the machine to the chassis, but it can be done. I recommend using the IBM hardware manual, available here:
http://www-307.ibm.com/pc/support/site. ... MIGR-46464

To access your encrypted disk (set up with Safeguard Privatedisk, which was originally included with the T42), you have to know your administrator password. If you don't, you can't recover the encryption keys.

The next step is to enter BIOS (F1 when starting up) and turn on the security chip.

The simplest way to recover the keys is to use the IBM Security Subsystem Administrator Utility. You can find it through the Control Panels. I'm running version 5.42.157.0. I don't know if there are later versions or if Lenovo has updated this from the T4x series. The utility will either immediately ask you for the administrator password or tell you that the security chip has been cleared (because you have replaced your system board, which includes a different security chip.) It then gives you the option of restoring your keys. For this to work, you have to actually have the key files from your hard disk. Mine were saved in the default location:
C:\Documents and Settings\All Users\Application Data\IBM\Security
You don't have to know the address. Use the default ones and you should be fine.

If the utility hasn't asked you for the admin password already, it will at this point. It will then restore the encryption keys. It takes about a nerve-wracking minute.

You can then use Safeguard Privatedisk as normal, enter your passphrase for your encrypted drive, and access your data.

It may also be a good idea to print out some of the instructions from the IBM security system documentation and Safeguard Privatedisk documents, since I couldn't find it online. The Safeguard software has gone through new versions/makeovers, and it doesn't seem that the version included with the Thinkpad is still supported. I didn't bother calling Sophos, which now owns Utimaco (the maker of Safeguard).

Separately from this, I did find a Lenovo doc that addresses how to recover the security keys when the system board has been reset:
http://www-307.ibm.com/pc/support/site. ... selected=5
However, this only applies if you are running IBM Client Security Software version 5.01, 5.02, 5.1 or earlier. I was running a later version.

One final observation-- I came across some posts where people complained about the IBM Client Security Software. In my view, it's not an especially user-friendly system, especially if you're a person who just wants to get down to work (i.e. whatever you're using the machine for) and not tinker with the machine. The fact that you have to deal with both the IBM system and the Safeguard Privatedisk software is a drawback. Another drawback: If you have a hardware failure (as I did), you have to rebuild your machine or find a compatible Thinkpad to put your hard disk into to get your data back. (I assume you could also put your hard disk into an enclosure, but you'd still have to connect it to a system running IBM CSS.) All of this is time-consuming and frustrating. In my case, I wish I had just kept all the data in the clear (or kept a copy in the clear and locked it away physically somewhere). Then, when my system board failed (the second time in four years), I could have just extracted the data from the hard drive, and never used the Thinkpad again.