[CDsDontBurn]

As the title says, this is what i need. something FREE is most desirable! if not free, then some kind of demo that has a trial period of a few days or a few uses. i don't care, lol.

the reason for this is to recover data off of a client's machine that is virus infested. it's so bad that i can't get into the control panel and make any modifications to the user accounts. this is the reason for a "password delete" utility of some kind. when i attempted to enter the user accounts, it would just hang there and do nothing. this is also true in safe mode.

i've checked out NTFS.com NTFS File System. Data Recovery Software. to look for something, and they do. it's called "active@password changer," but the problem with this is that the free version does not allow you to remove the password. also, i'm aware of the CTRL + F10 trick/security hole used during a windows repair. The problem with this is the lack of a windows disk. My client only gave me the Toshiba's driver disk but not the OS disk. The OS installed is winXP MCE. if it were winXP home, i'd use one of my disks for this.

any help on this would be much appreciated!

[BlueMak]

Is his system with XP or Vista?
If XP there are other ways without special software.

OK, nvm, I just read it properly lol.

I will PM you with a way to do it. It works some times so you might get lucky too.

[charm_quark]

the question is why dont you plug out the Hdd, and put it into another machine, then scan it there! however because of infection, some folders will be 'access denied' (because of acl's) then just use a linux machine to scan, and access the information

[edit] hey BlueMak, i also want to know how to do it!

[BlueMak]

Actually, I don't know what I was reading, but it wasn't what he wrote.
So, just forget it lol.

[CDsDontBurn]

Originally Posted by charm_quark

the question is why dont you plug out the Hdd, and put it into another machine, then scan it there! however because of infection, some folders will be 'access denied' (because of acl's) then just use a linux machine to scan, and access the information

[edit] hey BlueMak, i also want to know how to do it!

sorry, forgot to mention that i already did take the drive out of the machine and used it in another one. i was having issues with it in an external environment. like it wouldn't recogonize the drive or the drive kept on removing itself. winXP kept telling me that the "write protect" (or something like that, i don't remember what it was exactly) had failed. i put it back in the machine and it booted back up just fine. i think that might be due to the external USB HDD enclosure though.

yea, this is what has been happening to me. in the few times it was working just fine, i was only able to transfer out files that were in the C:\ directory. everything else under the user's account gave me that "access denied" message. i've come across this "access denied" message before and it was always caused by the user password.

somebody in another forum suggested that i use an ubuntu live disk for me to just transfer the files over from the HDD over to another HDD/storage device. but i'm not sure if i have to mount the extra storage device or have to do any sort of special commands in order for me to use the other storage device. it has been that is a requirement in my previous experiences with linux and that is something i don't know how to do. but, imna definitely go ahead and d/l an ISO of ubuntu live.

and blue mak, imna definitely try your idea. imna have to crack open my computer though since i think that USB enclosure i have has issues as it's own though, lol.

[BlueMak]

It should work, but, you won't be able to recover any password like that, only files.

[CDsDontBurn]

yea, i don't care about recovering the password. i want the password removed so i could access the drive w/o getting that "access denied" error when the drive is in the external USB enclosure. but, i'm starting to think that imna have to attach it to one of my available SATA ports of my computer instead because the USB enclosure has issues of it's own.

another alternative would be to use an ubuntu linux disk like i said earlier.

[Tipstaff]

Offline NT Password and Registry Changer. Head to that site, and download the bootdisk of your choice (floppy or CD). This program allows you to override any of the setting to do with the users passwords, including resetting the timer, and removing the password.

If you just want to find out the password then I recommend Ophcrack Live CD. Run this program, and depending on how fast the machine is it will crack the password for you. The great thing about this program is that it works on Linux, Windows, and Mac OS. Be sure to download the Live CD, and not the standalone program.

BTW, the access denied error you are receiving, it's not a password thing, it's a privacy thing. It means that when the user created the account he/she chose to make their stuff private. That means only they are allowed to see their files, as well as the administrator account on that local machine. In order to get access to those files you need to take ownership of the folder, preferably transfer the ownership to the administrator account, or the administrator group. It's best to do this on XP Pro as you will need to turn off "Simple File Sharing". Otherwise you won't be able to get to the security access control.

[Takaharu]

If it's just files you're after, slave the drive to a Vista machine. I've done this a few times and it works fine; Vista will create permissions for itself to access the drive. It's best not to use it as a USB - I had problems using this method when the hard drives were connected externally but not internally. It's odd, though, as the external adapter I use doesn't have any faults; anything else I want to use it for works fine.

[CDsDontBurn]

update:

i've tried ubuntu linux v9.04 (most current) like suggested earlier. i can see all the data just fine without any problems. however, whenever i attempt to transfer the data over, i get an error:

"Error stating file 'media/disk/backup_client/destination folder': input/output error

i think i might be getting this error due to the password set on the account. so, i think i'm back to square one where i need the password to be removed.

a friend of mine suggested that i use knoppix to do the file transfer. imna give that a try right now.

Originally Posted by Tipstaff

Offline NT Password and Registry Changer. Head to that site, and download the bootdisk of your choice (floppy or CD). This program allows you to override any of the setting to do with the users passwords, including resetting the timer, and removing the password.

If you just want to find out the password then I recommend Ophcrack Live CD. Run this program, and depending on how fast the machine is it will crack the password for you. The great thing about this program is that it works on Linux, Windows, and Mac OS. Be sure to download the Live CD, and not the standalone program.

BTW, the access denied error you are receiving, it's not a password thing, it's a privacy thing. It means that when the user created the account he/she chose to make their stuff private. That means only they are allowed to see their files, as well as the administrator account on that local machine. In order to get access to those files you need to take ownership of the folder, preferably transfer the ownership to the administrator account, or the administrator group. It's best to do this on XP Pro as you will need to turn off "Simple File Sharing". Otherwise you won't be able to get to the security access control.

for the password reset/change, i'm using winPE with ERD Commander. it doesn't allow me to leave the user accounts password less which is what i want. it just makes it so that i can change the password to something that i know.

thanks for letting me know about the error thing i've been getting. i've been totally thinking it was a password thing this whole time. where is this option to turn off "simple file sharing" located at? i'm thinking it's:

right click C:\ > properties > sharing

if not, then idk.

Originally Posted by Takaharu

If it's just files you're after, slave the drive to a Vista machine. I've done this a few times and it works fine; Vista will create permissions for itself to access the drive. It's best not to use it as a USB - I had problems using this method when the hard drives were connected externally but not internally. It's odd, though, as the external adapter I use doesn't have any faults; anything else I want to use it for works fine.

forr now, imna go try this.

[BlueMak]

Dude, why didn't you try what I suggested first? It works.

[CDsDontBurn]

because i was open to any and all ideas. i did everything that has been suggested to me in the order in which i received them. everything that i've been told to do has been said to work.

and sadly, i should have done your suggestion first because it is working for me right now. i've got roughtly 9GB of 20GB transferred over already .

next time though, i will do this first! because i know it works! unlike those other things i've tried that are also said to "work"

[Tipstaff]

Originally Posted by CDsDontBurn

because i was open to any and all ideas. i did everything that has been suggested to me in the order in which i received them. everything that i've been told to do has been said to work.

and sadly, i should have done your suggestion first because it is working for me right now. i've got roughtly 9GB of 20GB transferred over already .

next time though, i will do this first! because i know it works! unlike those other things i've tried that are also said to "work"

Can you guys let me in on the secret? Was I on the right track that it was a permissions/ownership thing causing the problem?

BTW, to respond about the simple file sharing thing, open up My Computer, then go to Tools, Folder Options, View, and uncheck the last option which should be Simple File Sharing. Once you do that a new tab will appear when you right-click a folder, that being Security. In there you can change all the permissions, as well as change the ownership options.

[CDsDontBurn]

the trick:

if you encounter a situation like mine, where the OS is too corrupted by viruses, spyware and/or malware, to work on directly where the corrupted machine using a winXP based OS, and the user has a password that cannot be removed due to the issues i just stated, thus simply transferring files over, regardless of the method (USB HDD enclosure or slaving/adding), from the virus corrupted disk to another winXP based disk will not work!

the way around to obtaining the user's/client's data from the machine is to place the HDD in a USB HDD enclosure or add/slave the HDD to a VISTA machine. for whatever reason, vista grants access to the HDD regardless of any permission attributes the corrupted winXP disk has.

idk how it is that this happens, but now i know it happens.

after these file transfers are all completed, i will format this HDD and get winXP installed fresh.

[Tipstaff]

Originally Posted by CDsDontBurn

the trick:

if you encounter a situation like mine, where the OS is too corrupted by viruses, spyware and/or malware, to work on directly where the corrupted machine using a winXP based OS, and the user has a password that cannot be removed due to the issues i just stated, thus simply transferring files over, regardless of the method (USB HDD enclosure or slaving/adding), from the virus corrupted disk to another winXP based disk will not work!

the way around to obtaining the user's/client's data from the machine is to place the HDD in a USB HDD enclosure or add/slave the HDD to a VISTA machine. for whatever reason, vista grants access to the HDD regardless of any permission attributes the corrupted winXP disk has.

idk how it is that this happens, but now i know it happens.

after these file transfers are all completed, i will format this HDD and get winXP installed fresh.

Interesting. I'll have to give that way a try. For the longest time I've always done the permissions thing, resetting all the permissions to full control, deleting permissions to everybody except "everyone" and "administrator", then changing ownership over to the administrator on all files and folders.

I'll have to remember to try it via the USB thing with Vista next time. Out of curiosity, which version of Vista did you use? I'm just wondering because with Business and Ultimate permissions come back into play, but not with the other versions.

[BlueMak]

Glad to be of help.

[CDsDontBurn]

Originally Posted by Tipstaff

Interesting. I'll have to give that way a try. For the longest time I've always done the permissions thing, resetting all the permissions to full control, deleting permissions to everybody except "everyone" and "administrator", then changing ownership over to the administrator on all files and folders.

I'll have to remember to try it via the USB thing with Vista next time. Out of curiosity, which version of Vista did you use? I'm just wondering because with Business and Ultimate permissions come back into play, but not with the other versions.

vista business. it's what i got from school.

[comp_ali]

That's nice infos.

[charm_quark]

i would say its weird that ubuntu says that!, because the way the security thing work in xp and ubuntu is different!

and sometimes if you have a virus infection it can even deny access to the administrator!, actually any user as your specifications!

try messing around in xp the command is called "cacls" crazy stuff actually, i cant use it well it works in some scenarios,, sometimes it doesn't..... i forgot to mention this earlier to try and use a program called "unlocker" and move the folder around,... but good that you were able to sort it out! ..

[CDsDontBurn]

now that i think about it (i was pretty tired last night, lol), i think that the reason why ubuntu gave me this error was more so because of the USB HDD enclosure i used. it was the same one that was giving me issues in a windows (vista and XP) environment.

[Tipstaff]

Originally Posted by CDsDontBurn

now that i think about it (i was pretty tired last night, lol), i think that the reason why ubuntu gave me this error was more so because of the USB HDD enclosure i used. it was the same one that was giving me issues in a windows (vista and XP) environment.

Not necessarily. Linux will still give you the same access denied errors on protected data.

BTW, an amendment to my advice (something that slipped my mind), and that is that you can access the same security section in Windows XP Home Edition by going into Safe Mode. Just can't remember if it works under the user account, or only under the Administrator account.

[Takaharu]

Originally Posted by CDsDontBurn

the trick:
The way around to obtaining the user's/client's data from the machine is to place the HDD in a USB HDD enclosure or add/slave the HDD to a VISTA machine. for whatever reason, vista grants access to the HDD regardless of any permission attributes the corrupted winXP disk has.

So yeah, what I said, albeit after BlueMak but my post was visible :P

[CDsDontBurn]

Originally Posted by Tipstaff

Not necessarily. Linux will still give you the same access denied errors on protected data.

BTW, an amendment to my advice (something that slipped my mind), and that is that you can access the same security section in Windows XP Home Edition by going into Safe Mode. Just can't remember if it works under the user account, or only under the Administrator account.

i'll have to try it again with a working HDD enclosure and another drive to test this. but, i don't doubt you .

wasn't aware of that. i'll check this out as well for next time.

Originally Posted by Takaharu

So yeah, what I said, albeit after BlueMak but my post was visible :P

haha, true. you'll get public credit for this as Blue Mak told me the same thing via PM .