Recovering data from Windows account

[Bluecube]

One of my Windows Vista PCs has thrown up an odd error. I'm not able to login to the only admin account as the password is not accepted and an error is thrown up saying that it can't connect to the service server. I've no idea about the hows or wherewhats of this but a long Google search isn't giving me any help. Of course there are a few unbacked up files in there that I need to save...

Briefly I'm looking to do one of two things -

1. Create a new admin account in order to take ownership of the old admin account and the files within it. Is this possible to do given that the two other accounts on the PC are user accounts?

2. If the above fails (or isn't possible) I was looking into using a live Linux setup to access the Windows disk and retrieve the files that way. I'm sure I read somewhere that this is possible but can anyone confirm before I go ahead and potentially waste my time?

TIA

[killie99]

Try this to remove the password:

http://pogostick.net/~pnh/ntpasswd/

[spoon_]

1. No not really, it would be a huge security hole.
2. Could do however you might be better off with Bart/Win PE.

Can't you just repair the existing installation?

Failing that you could always brute force the hash...

[peterb]

There are drivers available wihin most libnux disros for reading NTFS file systems. If they aren't available by default, the mainstream distros have them available in a repositry. NTFS=3G is the main driver.

If the files are on a separate partition you could re-install Vista (or upgrade to Win 7) and then as the admin on the new system, take ownership of the files and get them back that way.

Personally I'd be looking at the Linux root first to ensure the data is safe, before trying the second. If the data is on the same partition as the main OS files, then method one is the best (and possibly only) way to go.

[smargh]

Reboot in to safe mode - the "Administrator" account, which appears as disabled during normal use, should be available to log on to without a password when in safe mode.

Or, at least, that's what I think I recall when I last looked at a Vista laptop.

[watercooled]

I'd do as peterb said and get your data safe first, if you nuke your PC by mistake then at least you've lost nothing of importance. Linux ignores NTFS permissions by default (which is useful most of the time) so you won't have to mess about trying to crack the password or whatever first. The UBCD has a tool called something along the lines of 'NT Password and Registry Editor' which should be able to edit passwords quickly, provided you're not using NTFS disk encryption that is in which case you'd probably have to bruteforce to gain access which might take a wee while...

[Kumagoro]

I have come across this a couple of times before and did manage to sort both of them
but i cant remember how it wasn't that straight forward.

Even when fixed the samething happened again a month or so later.

I think that if there is still a password on the admin account you can sometimes create a new
one or turn on the proper Admin account from a standard user account.

Below worked for me one time and doing something like the above another

http://www.vistax64.com/tutorials/13...ot-loaded.html
http://blog.tiensivu.com/aaron/archi...-contents.html

[hibby]

Boot up from your Vista CD and run this from the command prompt in the recovery tools:

robocopy <path to copy> <path to destination> /S /B /COPY:DATOU

You might need to hunt for the right path as I just tried it out and my C: drive had moved to D: in the recovery environment. If it complains about not being able to find folders use Ctrl + C to stop it, add /XJ to the command and run it again (should work).

That should copy everything and put it all in the destination folder with everything intact apart from the file permissions, allowing access from any account.

[spoon_]

Might as well do DAT, unless owner/auditing info is needed which I don't expect to be the case.

[Joe of Loath]

Build a Linux USB stick and boot into that, and use it to copy the data to an external hard drive.