Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm away from home for college, and my computer back home has been having some issues. My dad took it to a computer store, and apparently the user profiles somehow got corrupted, so they're locked out of the computer. This is a Windows XP box, but I changed the default administrator account password, so that backdoor isn't a possibility.

Now, that computer's HDD has a whole bunch of data on it which my dad would hate to lose, so I suggested that they take the HDD out, plug it into some other computer, and just copy all the data off that way (keeping in mind that the data itself wasn't encrypted). However, the computer store people said that wouldn't be possible unless they had the administrator account password (which I can't remember for the life of me), and that they'd either have to reformat and reinstall Windows, or else use some complicated sounding recovery process costing a decent amount of money. That sounds like complete BS to me, but I'm not 100% sure about it, so I thought I'd get some more opinions. Could someone more knowledgeable about this stuff suggest a good course of action to take?

share|improve this question
    
possible duplicate of How do we retrieve data from an unbootable computer? –  Moab Nov 21 '11 at 16:56
    
That computer repair place is totally incompetent, don't go back, you don't need a password when copying data from a hard drive, and they should have reset the windows password while it was in the original PC, then they could have logged into Windows to repair the profile...pogostick.net/~pnh/ntpasswd –  Moab Nov 21 '11 at 16:59
add comment

1 Answer

up vote 0 down vote accepted

Get a livecd or liveusb - i like xubuntu for this, but any major distro with NTFS 3G would be good.

If you want to play it safe, make a copy of the drive with ddrescue.

Next, mount up the drive with ntfs-3g and see if you can copy files off it, if so, well, you're good - assuming the actual data you want isn't corrupted, you should be able to get it out.NTFS-3g is third party, but on occation can retrieve data off drives windows can't read

Next, you would probably want to try changing the admin password with the offline password changer, (which should let you log in as the admin), and if you can, delete and create the offending accounts

share|improve this answer
    
Perhaps, it's worth noting, that the actual referenced package is probably called gddrescue. However, the executable inside is called ddrescue. Also, maybe it would be slightly more reasonable to use dd instead, as it has a simpler, more obvious syntax than the aforementioned, which is more suitable for advanced needs (from my experience, it does not recover any more or less data than dd though). In case of bad sectors, arguments to dd should be conv=noerror,sync and oflag=direct. –  XXL Nov 21 '11 at 9:15
    
there's multiple rescue oriented varients of dd, and there are supposedly some advantages to the recovery oriented version if there's damage to the media. –  Journeyman Geek Nov 21 '11 at 9:26
    
Thanks a lot for the suggestions. So I take it that my idea of just plugging the HDD into a second computer as a secondary drive isn't feasible. Out of curiosity, why is that so? I understand that file ownership is built into NTFS, but since my files themselves weren't encrypted, and I had simple file sharing enabled, what exactly would prevent it from working? Since I'm not in town and won't be for a while, I want to give my parents as low-tech a solution as possible, which is why I'm asking. Thanks again for the help. –  m68z8mi Nov 21 '11 at 9:27
    
@m68z8mi, it is most likely feasible, but that's just an assumption that might not reflect the reality, as in case the drive has some data corruption in crucial areas - that might cause a reading anomaly with Windows, which will result in freezing/hanging when the drive is to be accessed. If that is the case, as JG has pointed out - ntfs-3g has a higher chance of properly mounting the filesystem, thus enabling you to get the data off. So, if the drive is actually fine and only corrupted on the software level of the OS (profiles), then the low-tech solution is the passwd reset app –  XXL Nov 21 '11 at 9:52
    
@JourneymanGeek: yes, dd_rescue (which is script-based from what I know) and ddrescue. Neither of them is able to actually recover any more data than dd. The only added extra value is the logging ability (adds resume) and a few tricks with reverse-reading/multiple passes. It still takes the same amount of time encountering a delay when trying to go through a bad sector. –  XXL Nov 21 '11 at 10:01
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.