12 Statement of memory volatility
For general information regarding nonvolatile memory in HP Business computers, and to restore nonvolatile memory that can contain personal data after the system has been turned off and the hard drive has been removed, use these instructions.
HP Business computer products that use Intel®-based or AMD®-based system boards contain volatile DDR memory. The amount of nonvolatile memory present in the system depends upon the system configuration.
Intel-based and AMD-based system boards contain nonvolatile memory subcomponents as originally shipped from HP, with the following assumptions:
● No subsequent modifications were made to the system.
● No applications, features, or functionality were added to or installed on the system.
Following system shutdown and removal of all power sources from an HP Business computer system, personal data can remain on volatile system memory (DIMMs) for a finite period of time and also remains in nonvolatile memory. Use the following steps to remove personal data from the computer, including the nonvolatile memory found in Intel-based and AMD-based system boards.
NOTE: If your tablet has a keyboard base, connect to the keyboard base before beginning steps in this chapter.
Current BIOS steps
Use these instructions to restore nonvolatile memory.
1.
Follow these steps to restore the nonvolatile memory that can contain personal data. Restoring or reprogramming nonvolatile memory that does not store personal data is neither necessary nor recommended.
a.
Turn on or restart the computer, and then quickly press esc .
NOTE: If the system has a BIOS administrator password, enter the password at the prompt.
b.
Select Main, select Apply Factory Defaults and Exit, and then select Yes to load defaults. The computer restarts.
c.
During the restart, press esc while the "Press the ESC key for Startup Menu" message is displayed at the bottom of the screen.
NOTE: If the system has a BIOS administrator password, enter the password at the prompt.
d.
Select the Security menu, select Restore Security Settings to Factory Defaults, and then select
Yes to restore security level defaults. The computer reboots.
e.
During the reboot, press esc while the "Press the ESC key for Startup Menu" message is displayed at the bottom of the screen.
NOTE: If the system has a BIOS administrator password, enter the password at the prompt.
f.
If an asset or ownership tag is set, select the Security menu and scroll down to the Utilities menu.
Select System IDs, and then select Asset Tracking Number. Clear the tag, and then make the selection to return to the prior menu.
160 Chapter 12 Statement of memory volatility
g.
If a DriveLock password is set, select the Security menu, and scroll down to Hard Drive Utilities under the Utilities menu. Select Hard Drive Utilities, select DriveLock, and then clear the check box for DriveLock password on restart. Select OK to proceed.
h.
Select the Main menu, and then select Reset BIOS Security to factory default. Click Yes at the warning message. The computer reboots.
i.
During the reboot, press esc while the "Press the ESC key for Startup Menu" message is displayed at the bottom of the screen.
NOTE: If the system has a BIOS administrator password, enter the password at the prompt.
j.
Select the Main menu, select Apply Factory Defaults and Exit, select Yes to save changes and exit, and then select Shutdown.
k.
Reboot the system. If the system has a Trusted Platform Module (TPM), fingerprint reader, or both, one or two prompts will appear—one to clear the TPM and the other to Reset Fingerprint Sensor.
Press or tap f1 to accept or f2 to reject.
l.
Remove all power and system batteries for at least 24 hours.
2.
Complete one of the following:
● Remove and retain the storage drive.
– or –
● Clear the drive contents by using a third-party utility designed to erase data from an SSD.
– or –
● Clear the contents of the drive by using the following BIOS Setup Secure Erase command option steps:
If you clear data using Secure Erase, you cannot recover it.
a.
Turn on or restart the computer, and then quickly press esc .
b.
Select the Security menu and scroll down to the esc menu.
c.
Select Hard Drive Utilities.
d.
Under Utilities, select Secure Erase, select the hard drive storing the data you want to clear, and then follow the on-screen instructions to continue.
– or –
Clear the contents of the drive using the following Disk Sanitizer commands steps: i.
Turn on or restart the computer, and then quickly press esc .
ii.
Select the Security menu and scroll down to the Utilities menu.
iii. Select Hard Drive Utilities.
iv. Under Utilities, select Disk Sanitizer, select the hard drive with the data that you want to clear, and then follow the on-screen instructions to continue.
NOTE: The amount of time it takes for Disk Sanitizer to run can take several hours. Plug the computer into an AC outlet before starting.
Current BIOS steps 161
Nonvolatile memory usage
Use this table to troubleshooting nonvolatile memory usage.
Table 12-1 Troubleshooting steps for nonvolatile memory usage
Nonvolatile memory type Amount (Size)
Does this memory store customer data?
Does this memory retain data when power is removed?
What is the purpose of this memory?
How is data entered into this memory?
How is this memory write-protected?
HP Sure Start flash
(select models only)
8 MB
Real Time Clock
(RTC) battery backed-up CMOS configuration memory
Controller (NIC)
EEPROM
256 bytes
64 KB (not customer accessible)
DIMM Serial
Presence Detect
(SPD) configuration data
256 bytes per memory module, 128 bytes programmable
(not customer accessible)
System BIOS 9 MB
No
No
No
No
Yes
Yes
Yes
Yes
Yes
Yes
Provides protected backup of critical System
BIOS code, EC firmware, and critical computer configuration data for select platforms that support HP
Sure Start.
For more information,
see Using HP
Sure Start
(select products only) on page 165
.
Data cannot be written to this device via the host processor.
The content is managed solely by the HP Sure Start
Embedded Controller.
This memory is protected by the HP Sure Start
Embedded Controller.
Stores system date and time and noncritical data.
RTC battery backed-up CMOS is programmed using
Computer Setup (BIOS), or by changing the Windows date & time.
This memory is not writeprotected.
Stores NIC configuration and NIC firmware.
NIC EEPROM is programmed using a utility from the NIC vendor that can be run from
DOS.
Stores memory module information.
DIMM SPD is programmed by the memory vendor.
A utility must be used to write data to this memory and is available from the
NIC vendor. Writing data to this ROM in an inappropriate manner will render the NIC nonfunctional.
Data cannot be written to this memory when the module is installed in a computer. The specific write-protection method varies by memory vendor.
Stores system
BIOS code and computer configuration data.
System BIOS code is programmed at the factory.
Code is updated when the system BIOS is updated.
Configuration data and settings are entered using the Computer Setup (BIOS) or a custom utility.
NOTE: Writing data to this ROM in an inappropriate manner can render the computer nonfunctional.
A utility must be used for writing data to this memory and is available
162 Chapter 12 Statement of memory volatility
Table 12-1 Troubleshooting steps for nonvolatile memory usage (continued)
Nonvolatile memory type Amount (Size)
Does this memory store customer data?
Does this memory retain data when power is removed?
What is the purpose of this memory?
How is data entered into this memory?
How is this memory write-protected?
Intel Management
Engine Firmware
(present only in select Elite or Z models. For more information, go to http://www.hp.com/ support . Select
Identify your product for manuals and specific product
information, and then follow the on-screen instructions.)
1.5 MB or 7 MB Yes
Bluetooth flash
(select products only)
802.11 WLAN
EEPROM
Camera (select products only)
2 megabits
4 kilobits to 8 kilobits
64 kilobits
Fingerprint reader
(select products only)
512 KB flash
No
No
No
Yes
Yes
Yes
Yes
Yes
Yes on the HP website; go to http://www.hp.com/ support . Select Find your
product, and then follow the on-screen instructions.
Stores
Management
Engine Code,
Settings,
Provisioning
Data and iAMT third-party data store.
Management Engine Code is programmed at the factory.
Code is updated via Intel secure firmware update utility. Unique Provisioning
Data can be entered at the factory or by an administrator using the
Management Engine (MEBx) setup utility. The third-party data store contents can be populated by a remote management console or local applications that have been registered by an administrator to have access to the space.
The Intel chipset is configured to enforce hardware protection to block all direct read-write access to this area. An
Intel utility must be used for updating the firmware. Only firmware updates digitally signed by Intel can be applied using this utility.
Stores
Bluetooth configuration and firmware.
Stores configuration and calibration data.
Bluetooth flash is programmed at the factory.
Tools for writing data to this memory are not publicly available but can be obtained from the silicon vendor.
A utility must be used for writing data to this memory and is made available through newer versions of the driver whenever the flash requires an upgrade.
802.11 WLAN EEPROM is programmed at the factory.
Tools for writing data to this memory are not made public.
A utility must be used for writing data to this memory and is typically not made available to the public unless a firmware upgrade is necessary to address a unique issue.
Stores camera configuration and firmware.
Stores fingerprint templates.
Camera memory is programmed using a utility from the device manufacturer that can be run from Windows.
A utility must be used for writing data to this memory and is typically not made available to the public unless a firmware upgrade is necessary to address a unique issue.
Fingerprint reader memory is programmed by user enrollment in HP
ProtectTools Security
Manager.
Only a digitally signed application can make the call to write to the flash.
Nonvolatile memory usage 163
Questions and answers
Use this section to answer your questions about nonvolatile memory.
1.
How can the BIOS settings be restored (returned to factory settings)?
IMPORTANT: The restore defaults feature does not securely erase any data on your hard drive. See question and answer 6 for steps to securely erase data.
The restore defaults feature does not reset the Custom Secure Boot keys. See question and answer 7 for information about resetting the keys.
a.
Turn on or restart the computer, and then quickly press esc .
b.
Select Main, and then select Apply Factory Defaults and Exit.
c.
Follow the on-screen instructions.
d.
Select Main, select Save Changes and Exit, and then follow the on-screen instructions.
2.
What is a UEFI BIOS, and how is it different from a legacy BIOS?
The Unified Extensible Firmware Interface (UEFI) BIOS is an industry-standard software interface between the platform firmware and an operating system (OS). It replaces the older BIOS architecture but supports much of the legacy BIOS functionality.
Like the legacy BIOS, the UEFI BIOS provides an interface to display the system information and configuration settings and to change the configuration of your computer before an OS is loaded. BIOS provides a secure runtime environment that supports a Graphic User Interface (GUI). In this environment, you can use either a pointing device (touch screen, touchpad, pointing stick, or USB mouse) or the keyboard to navigate and make menu and configuration selections. The UEFI BIOS also contains basic system diagnostics.
The UEFI BIOS provides functionality beyond that of the legacy BIOS. In addition, the UEFI BIOS works to initialize the computer’s hardware before loading and executing the OS; the runtime environment allows the loading and execution of software programs from storage devices to provide more functionality, such as advanced hardware diagnostics (with the ability to display more detailed system information) and advanced firmware management and recovery software.
HP has provided options in Computer Setup (BIOS) to allow you to run in legacy BIOS, if required by the operating system. Examples of this requirement would be if you upgrade or downgrade the OS.
3.
Where is the UEFI BIOS located?
The UEFI BIOS is located on a flash memory chip. You must use a utility to write to the chip.
4.
What kind of configuration data is stored on the DIMM Serial Presence Detect (SPD) memory module? How would this data be written?
The DIMM SPD memory contains information about the memory module, such as size, serial number, data width, speed and timing, voltage, and thermal information. This information is written by the module manufacturer and stored on an EEPROM. You cannot write to this EEPROM when the memory module is installed in a computer. Third-party tools do exist that can write to the EEPROM when the memory module is not installed in a computer. Various third-party tools are available to read SPD memory.
5.
What is meant by “Restore the nonvolatile memory found in Intel-based system boards”?
This message relates to clearing the Real Time Clock (RTC) CMOS memory that contains computer configuration data.
6.
How can the BIOS security be reset to factory defaults and erase the data?
164 Chapter 12 Statement of memory volatility
IMPORTANT: Resetting results in the loss of information.
These steps do not reset Custom Secure Boot Keys. See question and answer 7 for information about resetting the keys.
a.
Turn on or restart the computer, and then quickly press esc .
b.
Select Main, and then select Reset Security to Factory Defaults.
c.
Follow the on-screen instructions.
d.
Select Main, select Save Changes and Exit, and then follow the on-screen instructions.
7.
How can the Custom Secure Boot Keys be reset?
Secure Boot is a feature to ensure that only authenticated code can start on a platform. If you enabled
Secure Boot and created Custom Secure Boot Keys, disabling Secure Boot does not clear the keys. You must also select to clear the Custom Secure Boot Keys. Use the same Secure Boot access procedure that you used to create the Custom Secure Boot Keys, but select to clear or delete all Secure Boot Keys.
a.
Turn on or restart the computer, and then quickly press esc .
b.
Select the Security menu, select Secure Boot Configuration, and then follow the on-screen instructions.
c.
At the Secure Boot Configuration window, select Secure Boot, select Clear Secure Boot Keys, and then follow the on-screen instructions to continue.
Using HP Sure Start (select products only)
Select computer models are configured with HP Sure Start, a technology that continuously monitors your computer's BIOS for attacks or corruption.
If the BIOS becomes corrupted or is attacked, HP Sure Start restores the BIOS to its previously safe state, without user intervention. Those select computer models ship with HP Sure Start configured and enabled. HP
Sure Start is configured and already enabled so that most users can use the HP Sure Start default configuration. Advanced users can customize the default configuration.
To access the latest documentation on HP Sure Start, go to http://www.hp.com/support .
Using HP Sure Start (select products only) 165
