Ola:

We are conducting an investigation in cooperation with our corporate security group, our first, and our manager, who knows how to do this, is out. We have a laptop from the employee under investigation and we are wondering how to get the local SAM file from the laptop. We can't ask the employee, as they do not know they are under investigation. We are going to try an UltraBay, and reload the physical harddisk into it and try to get admin access to the harddrive. Any thoughts, leads, tools or ways to check out would be appreciated.

The machine is a IBM Thinkpad T40.
The OS is W2KPro.

Let me know if there are questions as well.

In advance,

Gracias.