Ola:

Well,

If you have an admin account on the machine... and the machine is connected to your network .....than you can pretty well copy any file off the laptop using the hidden admin share

\\machinename\c$


Although...there are procedures to "collect" info for investigations...depending on what your investigating, local laws, and if it needs to stand up in court. etc etc

MLF
Thanks for the reply back, but that's just it, we don't have admin access. Hold on...

...
OMG we just got it. We asked one of workstation analysts for an IBM ultrabay. We got the ultrabay, took the harddrive from the laptop we are looking at, put it into the ultrabay, loaded the ultrabay into bay of another IBM laptop we control and was able to mount the drive like a jump drive and pull over the SAM file. Took about 5 minutes total. Now off to use LC5. We are only going to get the admin pw and turn it all back over to our corporate security group. Thanks for the advice.

Buenos dias.