Locked out of hard drive--but I know the password!? Please help!

Ok, so the situation is, my computer BSODs at the login screen so I'm trying desperately to recovery whatever data I can from my laptop hard drive. The problem is, when I took out the drive and connnected it to an external enclosure, I can't access my Profile because I put a password on it and set the privacy settings for that Profile! Ahhhh!

The Profile is under "My Documents and Settings" and gives me an "access denied" everytime I try and access it. It also appears "empty", like "0" bytes empty. I've tried creating an account identical to the Profile I'm trying to access with the same Username and Password thinking I'll take those credentials but that didn't work. Please help me!!!!

Greeting's


if your hard-disk has developed physical bad sectors (it must have if you notice an increase in amount of time it takes too boot or it hangs at boot).. then you must no try to access data rather you must just copy as much data as you can off that hard-disk to a new (or different) one then you must try to get data (i.e. to access your account and other things)... Keep your first priority to recovering (copying) data from that hard-disk.

I prefer :
http://www.lnx4n6.be/index.php?sec=D...ds&page=bootcd

(i just checked the link and seems to be down for the time being... Ill search for some good one's (free) and update... Till then take care and dont use the disk too much.)



EDIT :

Okay there are a binch of freeware's that you can get here... but just for the sake of it please use the software... get to know it and then use it on the damaged hard-disk..

http://sourceforge.net/search/?type_...=data+recovery

Thanks for the quick reply ByTe, I can no longer log into windows using that hard drive. I can access pretty much everything on the drive using an external enclosure except for my Admin Profile, in which I kept alot of important information.

I was wondering if there was a way for me to access that folder with the drive being in the external enclosure since I know the password for the profile already? Or a way to get the drive to accept my Profile's credentials?

You don't need the password. Take ownership of the files.

Quote:

---

Originally posted here by SirDice
You don't need the password. Take ownership of the files.

---

Correct. Unless of course, they decided to use encryption on their profile (EFS). If they didn't export their key and save it in a safe location... then as far as I know... they're fscked. However, normally just taking ownership is enough.

A laptop huh?

Bad news pal, it probably has a hard drive encryption and password protection algorithm. I guess you should talk to the manufacturer first.................. you did not tell us the make and model?

If you can prove ownership, then they will help you ( at a truly horrific price :eek: )

The problem with modern lappies is they all have their own way of dealing with security :(

I really need more specific information mate!

I had a drive go bad in my laptop which is an HP 8000 and I was running EFS at the time. More specifically I had encrypted my profile to protect My Documents and my application data. I had dropped the laptop about 3ft and caused massive bad sectors. I removed the drive from the laptop and mounted it in a external enclosure, and attached it to my workstation with an admin account. The admin account I was using had the same credentials as my laptop profile, but I had to still take ownership of the files because of the difference of the sids. After running a scan disk that ended up taking 18 hours for a 40 gb drive I was able to retrieve my data. So much for EFS.

Quote:

---

The admin account I was using had the same credentials as my laptop profile

---

Net2- What do you mean the admin account had the same credentials? If it was a domain, domain admin is usually a recovery agent.

Local machine admin accounts will have a different SID, so the credentials will not be the same... Unless you copied the EFS key between the machines before the one machine died there is no way you just swapped disks and it magically worked.

I would suspect you didn't have EFS setup properly. People have been trying to hack EFS since it came out. I doubt you just accidentally did it.

Hey guys, sorry for not being more specific. The laptop I have is a IBM r50e Thinkpad running Windows XP Pro. I really think I'm screwed now because I was running EFS on the machine.

mohaughn has brought up an excellent point about encryption....

Unless you have a copy of the key stored somewhere else....your pretty well flucked :eek:

vynkz...I am not sure about "drive" encryption

but if the whole drive was encrypted...then you shouldnt have access to any of it???

No :what:

MLF

I know this is a Ridiculously simple question to ask but noone has asked.... have you tried logging in under safe mode? You said it was giving the BSOD at the login screen? What message is the BSOD giving?

Would renaming the windows directory to wintemp and installing windows on the same drive again fix the issue?

Can you run the repair option from the disk?

Hmmm...wait a min, I had a boot password setup, I thought that was the EFS everyone was talking about? I thought that encrypted all your files? I did it so long ago that I forgot what it was called, I think I typed a command up in a windows prompt and it came up asking me to input a boot password. Can't remember what that was called though for the life of me!

Quote:

---

Originally posted here by Spyrus
I know this is a Ridiculously simple question to ask but noone has asked.... have you tried logging in under safe mode? You said it was giving the BSOD at the login screen? What message is the BSOD giving?

Would renaming the windows directory to wintemp and installing windows on the same drive again fix the issue?

Can you run the repair option from the disk?

---

It also BSODs at a safe mode login attempt :( The BSOD message unfortunately appears for a nanosecond and restarts my laptop :( I've tried to do windows recovery console it also BSODs me there :(

Hey, I've finally gotten the external enclosure to recognize the drive and took ownership of the files I needed as suggested by you guys! Thanks for all the help guys, boy am I a newb or what!!!!

Quote:

---

Originally posted here by mohaughn
Net2- What do you mean the admin account had the same credentials? If it was a domain, domain admin is usually a recovery agent.

Local machine admin accounts will have a different SID, so the credentials will not be the same... Unless you copied the EFS key between the machines before the one machine died there is no way you just swapped disks and it magically worked.

I would suspect you didn't have EFS setup properly. People have been trying to hack EFS since it came out. I doubt you just accidentally did it.

---

I created an account on the workstation that had the same username and password as I had on my laptop. As I mentioned it had a different SID, so I had to take ownership of the files. I may not have had EFS setup properly, but the name of the folder that I encrypted was in green to indicate it was encrypted. Both the laptop drive and the recovery drive were both formated as NTFS. I dont have any idea why it worked but I am sure I can lab it up in vmware and try it out.

Net2Infinity

Me thinks that the encryption key or a recovery agent was used on the drive
you slaved in...hence being able to de-crypt it ;)

Quote:

---

EFS is designed to protect the privacy of sensitive data. Besides the user who encrypts a file, only designated recovery agent personnel can decrypt it. Other system accounts that have permissions for that file — even the Take Ownership permission — cannot open the file without the encryptor's private key.

---

or part of a domain as stated earlier

Quote:

---

Designated user accounts, called recovery agent accounts, are issued recovery agent certificates with public keys and private keys that are used for EFS data recovery operations. Recovery agent accounts are designated by EFS recovery policy. By default, the recovery agent account is the highest-level Administrator account. On a stand-alone computer, this is the local Administrator. In a domain, the domain Administrator for the first domain controller installed in the domain is the default recovery agent account for all computers in the domain. Different recovery agent accounts can be assigned by changing EFS recovery policy, and different recovery policies can be configured for different parts of an enterprise. The private key for a recovery agent account must be located on the computer where recovery operations are to be conducted.

---

http://http://www.microsoft.com/reso...k_efs_duwf.asp

so what is it????

Enquiring minds need to know.. :D \


MLF

edit >sorry that link doesnt work....here is another
http://www.microsoft.com/resources/d...k_efs_duwf.asp

Quote:

---

Do not encrypt files when you are logged on as the local Administrator unless you have changed the default recovery agent account. The effectiveness of EFS recovery is compromised if a file's creator is both the user and the recovery agent account.

---

wow...a :eek: bug

Neither the laptop or the workstation were on a domain, nor were they even in the same workgroup for that matter. I will have time to lab it up this weekend as I believe I have a ghost image of the laptop drive around here.