Circumventing XP "Make this folder private" protection

Sorry if this is a bit long, but I don't want to miss any details, so I won't have to clarify later on:

About a year ago, while messing around with my XP system, I enabled the "Make this folder private" option on a folder full of C++ programs and perl scripts I was working on (Also some documents and music, but these are more easily replaced). Later, my Windows installation got corrupted, and when I re-installed, I could find no way to access my files. I asked around on various boards and did a lot of Google searching at the time, but couldn't find a way to get into these files.

Something about my hardware configuration (or possibly software...I never figured out the problem, but it went away when I got a new motherboard) kept corrupting my windows files, so I would have to reinstall. Tired of loosing files to this, after the second time I repartioned my 40GB HD into a NTFS c: drive for Windows and programs and a FAT32 d: drive for documents, data, etc.

As if fate was still determined to destroy my files, I realize one day that several of my files are missing. I find them in the recycling bin, and the date deleted is a time when I was not on the computer. Nobody fesses up to it, but I figure one of my family members accidentally (?) deleted them. Used to NT and Linux file permissions, I try to use Administrative tools to change folder permissions on it to read only, but there didn't seem to be this functionality on XP. The closest thing I could find was the aforementioned option. It only seemed to work on the My Documents folder, and then only when the My Documents folder was in C:\Documents and Settings\ (I had moved it to D:\My Documents using TweakUI). So I moved the My Documents folder back, and enabled the privacy option on it. Take that, fate!

Several months later, my Windows installation gets corrupted again. Before, I had been doing a format c:, then a re-install, but now, since my important documents were on the c: drive, I just did a standard re-install that keeps all of your old windows settings and whatnot. I used the same username for the admin account ("Blaize"). When I went to c:/documents and settings, there was now a Blaize, and a Blaize.LOCAL. The Blaize folder, containing my documents, gave a "This folder is private" or similar error when I tried to open it.
running the hard drive as a slave on a NT 4.0 system, but nothing worked. Nobody on various message boards was able to help me either.

I tried at the time to get my data through boot disk prompts, and anything else I could think of, without success. As I had 10000+ lines in the folder, and about a month of work done since my last backup, I was quite despondant. I more or less have given up on those projects (they were recreational, not for work), but I'd like to get them back.

Now I have a new XP system and I would be able to run my old drive as a slave, so my question is how do I get my files back?

Also, what methods (other than more frequent backups) can I use to protect my files from deletion without this problem occuring again?

Thanks

If you log in as administrator you should be able to take ownership of the files.

Seems to me that you have several things going on. The Admin logon should take ownership of the files. You can mask future files by giving it a simple name and hiding it within another file. You now know the importance of backups (and yeah, after making this statement, I'd better do the same). And, the NTFS allows security whereas FAT32 doesn't. Not much of an answer, but something to think about for the future.

If you still have a Fat 32 partition or can created one, download NTFSDOS from SysInternals.
( http://www.sysinternals.com/ntw2k/fr.../ntfsdos.shtml )

It's run from a Win98 boot disk. From there, you could copy NTFS file to your Fat 32 partition where their is no security on file. I also recommand that you do a backup of your file on a CD for the next time! Good Luck!

From what i understand from your post it would seem your major problem is, other people useing your pc. If you have to let family members have access, control what they can and can not do by giving them limited accounts.

If you slave your old drive in your new system you should be able to access them in the normal way, useing windows explorer. If this is not the case it maybe that the file system on that drive is corrupt. In this case you will have to use a file recovery app. SDK's linked you to a specific app but if you have a look at the main site you will find a few apps that will recover files for you. (a hint, always install to a drive other than the one you want to recover from. So you don't over wright what you want to recover)

Hope this helps.


Jinxy

Actually, the problem is that you made those files private. When you create a new profile windows gives that profile an ID. When you make folders private, only a user with that ID can view the files. The ID is not based on a name, so using the same name won't do squat.

What SDK said about heading to http://www.sysinternals.com/ and using ntfsdos might work, but i've never tried.

There might also be a problem if you encrypted the data in those folders (I know XP pro can do this). Then your files are as good as gone (unless some cracker broke the encryption, which I doubt). The encryption is also based on your UID, so that would be un-recoverable.

As for logging is as admin, I just did that on my laptop (windows xp pro) and i still could not access the files in a private folder.

So, in conclusion... i would say your best bet is to hit http://www.sysinternals.com/ pick up ntfsdos and hope you can get the files that way.

Sorry for the bad news

Quote:

---

As for logging is as admin, I just did that on my laptop (windows xp pro) and i still could not access the files in a private folder.

---

He is not talking about logging in as an administrator. HE IS TALKING ABOUT THE ADMINISTRATOR.

Jinxy, it still doesn't work that way unless he created it from THE admistrator account, as it is created with a different ID as well... He said he locked them down from his own account, so it still wouldn't work...

NTFS dos sounds like about the only possible way out of this one... I thought a while ago I heard of some program which would brute force it in a way by trying every possible ID, but I don't remember the details of it or if it even exists or was just an idea.

Quote:

---

I used the same username for the admin account ("Blaize"). When I went to c:/documents and settings, there was now a Blaize, and a Blaize.LOCAL

---

Above is the give away. The way i see it. On install you have the option to set a Administrators Password You do not get to choose a different name.

Later when the os is installed you are asked to enter user names and passwords and if you would like to make files pertaining to these users private. Assuming you do nothing els at this stage you will continue to windows. From there you can change account types etc from within the control panel. If you do not change account types, by default every user entered at the first start of windows will be an admin.

However there is a Hidden The Administrastors account. To access this you nead to either press f8 on bootup and boot to a diagnostic option or boot from your win xp cd. Either of these options will give you the option to log in as The Administratoror another user. If a password is set at install for The Adinistrator and you log into that account you have complete control of the system. Period.

Jinxy

Jinxy, I am sorry to say, but you are incorrect. I just tried it on my own system it DOES NOT WORK! you still have a different user ID on the adminstrator account. BTW, another way to get into it is to press ctrl-alt-del at the welcome screen and type adminstrator into the box.

the grunt is right... and i did log in as "Administrator" for my experiment. I already had the "welcome" screen disabled, so logging in was just like hitting ctrl+alt+del twice from the welcome screen.

Private files are kept PRIVATE. only the user with the UID that made the files/folders can access the files/folders

But i just had a brainstorm.... doesn't the linux kernel 2.6 have ntfs support? you might have a way to get the files by booting a boot-cd distro like knoppix or phlak

Yes you can useing Knoppix i just tried it.

My point about the Admin account is you can still access private files by changing the access control lists. You have admin and physical control you own it. Type CACLS in cmd. Have a look at what it producess

Quote:

---

Also, what methods (other than more frequent backups) can I use to protect my files from deletion without this problem occuring again?

---

Simple recommendation would be to get a few CD-RWs and make a few cheap "v1.0" backups. This way, if you lose them later on, you can still have a CD with them on it. When you update your source and things all look good, verify the source on the machine, erase (format) the current CD-RW and burn a new copy. If you have SourceSafe (I think that's it) for MS, you can check your stuff in and have your own CVS-esque tree otherwise you could use CVS and CVSWeb on a linux box to make sure you keep integrity and all tracked changes intact.

I know my reply is a bit tardy, but I've been working sun up to sun down the past two weeks and havn't had time to check the forums until now.

Thanks for all the advice. I didn't encrypt the files (luckily), but I was worried that that might be what making the files private does. Now that I know that that isn't true, I think I will take annihilator_god's advice and try to get them through linux. My current distrobution is about three years old and doesn't do NTFS, but I've been wanting to get a new one for a while anyway. If that doesn't work I'll try NTFSDOS.

I had already tried logging in as "Administrator" from the login screen (I had the welcome screen disabled as well, so the login is a NT style username and password dialog)

As for giving family members limited accounts, I did this, but I didn't see any way of taking away write permissions from selected files but not others. This is not so much of a problem now, as I am not living at home anymore.

I can't get to work on it right away, because I'm taking a VERY full load at college (using the standard on in two out formula its 63 hours of work a week, but it seems like much more, because I'm in several lit classes...not my forte). Luckily it's only for another 4 weeks, so I should be able to work on it after that, and I'll post how it works out.

Thanks again for the help

OK, since no one can give you the solution, here you go....

1. Log in as an administrator. It'll help if you give the account you want to use these files with admin rights and log in as that account. You can take them away after this is done later.

2. Disable simple file sharing (My Computer -> Tools -> View -> Uncheck "Use simple file sharing (recommended)" ). You should actually do this even if you don't have a problem. It helps you secure your computer better.

3. Right click on the folder, select properties.

4. Click on the security tab.

5. You should see a long random number (something like 34556-565623-35653-23424). Click on it and click remove.

6. Click add and type in your username and press OK. Give the account full control.

7. Click the advanced button. Under the permissions tab, uncheck the box next to "Inherit from parent..."

8. Click the owner tab. Select your username. Check "Replace owner on sub containtainers and objects" and click OK. This could take a looooooooong time, so be patient.

9. You're done!

I don't know if this'll work on XP Home, but it definitely works on Professional.

Cheers,
cgkanchi

EDIT: Disabling simple file sharing changes the Access Control System for files in XP to something VERY similar to the one found in 2K. Thus, you can give access to certain files and not to others.

Cheers,
cgkanchi

See this info.. Directly from Microsoft!

http://support.microsoft.com/default...308421&sd=tech