0

So I have an old hard drive which ran Windows XP. The rest of the computer was scraped. I can't recall the login password for the user on that hard drive. I want to recover files from this hard drive.

My question:

If I get an adapter and connect it to my PC running windows 10 will I be able to simply access the drive as if it was a new drive and browse the files? If not how do I retrieve the files?

Also if I want to completely copy the content of the disk to a new hard drive can achieve that with a tool like deamon?

1
  • You are overthinking this: Unless the hard drive is encrypted—or damaged—you can just connect the drive to an adapter, it will mount on your system like any other device and you can just copy files off of it like anything else. Feb 12, 2019 at 0:04

1 Answer 1

3

If I get an adapter and connect it to my PC running windows 10 will I be able to simply access the drive as if it was a new drive and browse the files?

Yes. Assuming the drive is functional and not encrypted.

Also if I want to completely copy the content of the disk to a new hard drive can achieve that with a tool like deamon?

I’m not familiar with this tool, but a simple-drag and drop should be sufficient. You would have no reason to copy the entire drive. Most of it is useless windows and program files. You’re really only interested in the data which should be under \Documents and Settings

4
  • 2
    Wow I honestly wasn't expecting it to be thus easy. So the windows account doesn't really provide much security.
    – mouse_s
    Feb 11, 2019 at 23:38
  • 2
    @mouse_s Short of full drive encryption, there is no expectation a drive is secure if you have physical access to it. Feb 11, 2019 at 23:50
  • 2
    @mouse_s - Sure it does; However, if it were encrypted (EFS) the situation would be different, additionally it’s only possible to take ownership of your an Administrator. Since that is the case you can take ownership of the files. This is true on any OS by the way. It’s even easier on OS X and Linux.
    – Ramhound
    Feb 11, 2019 at 23:51
  • To add to this, I would recommend OP to immediately image the drive (using dd for example on a live Linux install) if the drive is faulty in any way - you don't want to gamble on a faulty drive, but once you've made a 1-to-1 image, you can read from it indefinitely and take what you want. The same principle applies to forensics but for a different reason.
    – QuickishFM
    Feb 12, 2019 at 9:33

Not the answer you're looking for? Browse other questions tagged .