Update Feb/08: Unfortunately this solution seems to work only for harddrives smaller than 120 GB, because the HPA-Toolkit get confused with drive sizes that big. As a workaround I simply kept my old (small) drive with the original HPA on it. On that drive (20 GB) I can always restore Windows. Fortunately the Windows partition can be copied 1:1 to another drive (as long as the new drive will be running in the same machine). Phew!


The goal of this page is to provide a (tried-and-tested) translation of a German thread about transfering the Hidden Protected Area of modern laptops like Thinkpads or Samsung ones from the original harddisk to a replacement device.

I have an IBM Thinkpad X31 and have tried the presented solution, but I cannot guarantee that it will work for you too. Y.m.m.v.

After fiddeling around with the original IBM instructions (from the Predesktop Area white paper) and some DOS based boot floppies and even BartPE without success I tried the only promising Linux solution to this problem: HPA-Toolkit (sorry, links to a german only page). And it worked for me (TM)! Thus I decided to provide a translation with Thinkpad specific instructions. Here it is ...

What is the problem?

The problem is that IBM does not provide any recovery CDs for modern Thinkpads. Instead they pack all the software necessary to recover to delivery state into a secure part of the original harddisk called Hidden Protected Area. Since this is no ordinary partition you cannot simply copy it around. See the IBM Predesktop Area white paper for details.

The solution

The solution was invented by a guy who names himself moyamu. He wrote a suite of tools called HPA-Toolkit. With a recent Linux Live CD or any other kind of Linux running on your Thinkpad plus the HPA-Toolkit it is relatively easy to migrate the HPA to a blank new harddisk.

Get the HPA-Toolkit up and running

Fetch the tarball from the original site and unpack it:

wget http://freenet-homepage.de/moyamu/sw/hpatools/hpatools.tar.gz
tar -xzf hpatools.tar.gz

Now enter the new directory and compile the software:

cd hpatools

This should result in a couple of binary executables of which only two are necessary for our purposes: disksize and editbeer. You will need them to restore the HPA on the blank drive. Copy them on a USB stick or wherever you will be able to access them later.

Save the original HPA

  1. Boot into the Linux of your choice (e.g. Knoppix from USB-CD).
  2. Run dmesg and search for hda. You should find something like (otherwise you need to set the Security Level for the predesktop area to Normal Security in the BIOS setup):
    hda: Host Protected Area detected.
    	current capacity is 71367666 sectors (36540 MB)
    	native  capacity is 78140160 sectors (40007 MB)
    hda: Host Protected Area disabled.
    hda: 78140160 sectors (40007 MB) w/1740KiB Cache, CHS=65535/16/63
    This shows how big the HPA is: 78140160 - 71367666 = 6772494 sectors of 512 byte. Alternatively these values can also be retrieved through the command
    disksize /dev/hda
    It also gives us the number of the first sector of the HPA: 71367666 + 1, thus we need to skip 71367666 sectors when reading the HPA.
  3. Save the HPA (approximately 3.3 GiB) to a safe place (e.g. over NFS version 3):
    dd if=/dev/hda of=<destination> skip=<value of current capacity from above>
    You need to replace each pair of brackets (<...>) with a value that fits the description between the brackets. Do not confuse if= with of=! That could lead to irreversible destruction of harddisk content.

That's all the magic for this step. Shut down and replace the harddrive with the empty one.

Restoring (installing) the saved HPA on an empty drive

If you have data on the concerning harddisk now is the time to copy it to a safe place, since all data on the drive is at risk in this part of the procedure.

  1. First boot the Thinkpad and enter the BIOS Setup (press F1 as soon as the first splash screen appears). Enter the Security submenu and disable the IBM Predesktop Area.
  2. Save and Exit (F10).
  3. Boot again your Linux of choice. Do not forget to make the two executables from above available now.
  4. Check the new drive size:
    disksize /dev/hda
    output looks like (will be in german, translations added by me)
          39070080 = 0x02542980 Sektoren = 20004 MByte gesamt    // means "total"
          39070080 = 0x02542980 Sektoren = 20004 MByte sichtbar  // means "visible"
          39070080 = 0x02542980 Sektoren = 20004 MByte belegt    // means "used"
    Check whether the values in the first two lines are equal. If they differ then the Predesktop Area is not disabled and there is already a valid HPA on this drive.
  5. Now you need to determine where to write the HPA image you created previously. It needs to be precisely placed at the very end of the drive. We already know the size of the drive (it's 39070080 sectors in the example above). The size of the HPA (in sectors) can easily be measured with ls -l --block-size=512. In my case the HPA (and also its image) had a size of 6772494 sectors. (Warning: Do not use du -B 512 to determine the image size! In my case it gave me an incorrect value which was 10 sectors too high.)
  6. Now we can calculate the difference between the two values to see where to start with writing the image to the new disk. Calculate <startsector> = <disksize> - <imagesize> in unit of sectors. (E.g. 39070080 - 6772494 = 32297586)
  7. Finally you can write the image to the harddrive:
    dd if=<image> of=/dev/hda seek=<startsector>
  8. Check whether the image was written to the correct position by looking at the BEER entries:
    $ ./editbeer /dev/hda show
      Signatur:      0xbeef (ok)
      Prüfsumme:     0x9dcd (ok)
      Flags:         0x0029
      Geometrie:         C     H     S   B/S    Sektoren
        berichtet    16383    16    63   512    78140160
        formatiert   16383    16    63   512    78140160
      Zeitstempel:   2003-12-22 00:00:00
      HPA-Start:     71367666 = 0x440fbf2
      Bootsektor:    77932465 = 0x4a527b1
      Revision:      0x0
      Device Name:   IC25N040ATMR04-0                        
    Directory of Services (8 Einträge):
      #   ID  Name                           Startsekt. Sektoren Icon       Flags
      - ----- ------------------------------ ---------- -------- ---- -----------
      0     0 FirstWare Reserved Area          77935351   204800 0x00 0x03 ----hb
      1   256 SIGHT                            77932465     2886 0xfc 0x21 d----b
      2 33025 Create Diagnostic Diskettes      77917405    15060 0x24 0x21 d----b
      3 33024 Run Diagnostics                  77902345    15060 0x23 0x21 d----b
      4 33028 Restore from backup              77899462     2883 0x22 0x21 d----b
      5 33029 Rec Boot                         77884402    15060 0x21 0x21 d----b
      6 34816 BIOSWORKAREA                     77880306     4096 0x21 0x06 ---eh-
      7 34952 Rec Data                         71367666  6512640 0x21 0x06 ---eh-
    If you get an error message then you need to check the numbers in previous steps (disksize, etc.).
  9. Otherwise you need to adjust some of the numbers above to match your current drive geometry by adding a certain offset. The offset calculates as follows: <offset> = <size of new disk> - <size of old disk> (in unit of sectors). In my example the offset is 39070080 - 78140160 = -39070080 (yes, it's negative since the new disk is smaller than the old one).
    • First let's set the drive size (in unit of sectors):
      ./editbeer -v /dev/hda modify disksize=<total size of new drive>
      ./editbeer -v /dev/hda modify disksize=39070080
    • Optionally set the name of the drive:
      ./editbeer /dev/hda modify name="$(cat /proc/ide/hda/model)"
    • Set the start of the HPA to the new value (<startsector> from steps 6/7):
      ./editbeer /dev/hda modify hpastart=<startsector>
    • Set the bootsector next:
      ./editbeer /dev/hda modify bootsector=<old value + offset>
      in my case I did
      ./editbeer /dev/hda modify bootsector=$(expr 77932465 - 39070080)
    • Finally change all of the entries of the Directory of Services. For each line in the table above do the following:
      ./editbeer -v /dev/hda modpsa <#> start=$(expr <Startsekt.> + <offset>)
      I did for example:
       ./editbeer -v /dev/hda modpsa 0 start=$(expr 77935351 - 39070080)
       ./editbeer -v /dev/hda modpsa 1 start=$(expr 77932465 - 39070080)
       ./editbeer -v /dev/hda modpsa 2 start=$(expr 77917405 - 39070080)
      and so on.
  10. Now reboot and enter the BIOS setup. Enter the Security submenu and enable the IBM Predesktop Area.

Restoring pre-installed Windows

The main motivation behind all this is to be able to restore the Windows XP pre-configured by IBM. It does not need to be activated and has lots of Thinkpad-specific drivers and tools installed.

  1. Boot and press Enter while the first splashscreen appears. This will bring up the predesktop area.
  2. Select "Recovery to factory contents". Follow the instructions as usual.
  3. The recovery process starts and takes its time. The process includes several reboots. In my case the originally created FAT32 partition was not bootable in the beginning. I used a bootable GRUB CD to boot from the first partition. To do that boot the CD and type c for console. Then enter the following:
    rootnoverify (hd0,0)
    chainloader (hd0,0)+1
    Then the process continued. In my case I had to do that about five times. After that the system was made bootable by Windows itself.
  4. After successfully restoring Windows XP the whole disk is consumed by one huge NTFS partition (drive C:). To make room for Linux I defragmented drive C: and resized it afterwards with GParted from Parted Magic.

last edited 02/27/2008,