Retrieving the SAM file.

C

cam966251

[H]ard|Gawd
2FA
Joined
Aug 23, 2005
Messages
1,300
Hi, i have a simple question.

I need to get to an old computer i have that i have lost the password. I have tried to boot to a CD in linux (knoppix-STD) and MS-DOS, i am jsut having problems copying the sam file on the C:\ drive to a thumb drive. i know how to get the password once i get the SAM but i just need gelp copying the SAM from the C:\WINDOWS\system32\config folder.

Whats the command i would use to copy the file. in either MS-DOS or Knoppix-STD or PHLAK.

I am also unable to get standard knoppix to boot because it keeps going into DOS and i am burning with nero6, i am using Windows XP.

it jsut says A:\


Thank you for your help and time.

PS. This is my PC and there are no illeagal activity going on, thank you
 
You cant acess the file with that program, i dont wanna reset it, but thank you.
 
Alright, i just Knoppix 4.0.2 finaly working, nero6 just doesnt burn ISO's correctly.

Thank you
 
KoolDrew said:
Just boot it up from a floppy and it only takes like 10 seconds to get rid of the password. Then log in and set a new password.
Click to expand...
i dont wanna reset it
Click to expand...
There are many reasons why the OP or anyone else may not want to reset the password.
 
Then please, why not highlight some of those wonderful reasons for us? You see, all I can think of with the scant info and the general questions that have been asked so far are two things:
  1. Someone else still uses the computer, and the original poster doesn't want someone to know they have the password
  2. This is a school or work computer, and changing the admin password will alert the real administrators

If this is her/his own personal computer, then changing the password won't break anything, won't lose anything (except the old password), and gives access to the OS itself. Period.
 
GreNME said:
If this is her/his own personal computer, then changing the password won't break anything, won't lose anything (except the old password), and gives access to the OS itself. Period.
Click to expand...

I can think of one. Say you have an employee who has admin rights to a system who decides on their way out to change that password, among others on systems not as easily recovered, the password tehn becomes valuable.

As a side note...never fire the net admin of a small company before getting someone else setup with admin access.......this scenario was related to me just recently.
 
Spectre said:
I can think of one. Say you have an employee who has admin rights to a system who decides on their way out to change that password, among others on systems not as easily recovered, the password tehn becomes valuable.

As a side note...never fire the net admin of a small company before getting someone else setup with admin access.......this scenario was related to me just recently.
Click to expand...
That's an awful lot of caveats, and I can guarantee that there is a way to change every single one of those other "not as easily recovered" passwords.
 
GreNME said:
That's an awful lot of caveats, and I can guarantee that there is a way to change every single one of those other "not as easily recovered" passwords.
Click to expand...

Of course there probably are but when they need it done now with no data lost you go for the weak link...windows.

Not saying this is this guys case...but simply a funny case that came up recently that was tangently related.
 
djnes said:
Only if user error is to blame. Nero6 burns .isos perfectly fine.
Click to expand...

It makes a DOS boot disk for those files. I must be me, i think i corrected my error when i was using Alcohol %120 and it seemed like it was nero6, my bad.
 
GreNME said:
Then please, why not highlight some of those wonderful reasons for us? You see, all I can think of with the scant info and the general questions that have been asked so far are two things:
  1. Someone else still uses the computer, and the original poster doesn't want someone to know they have the password
  2. This is a school or work computer, and changing the admin password will alert the real administrators

If this is her/his own personal computer, then changing the password won't break anything, won't lose anything (except the old password), and gives access to the OS itself. Period.
Click to expand...

I have old files on accounts on the computer i am trying to get to, it is all my stuff, only person who uses the computer. i jsut need to obtain files from a user account, and resetting the account password would render the ability to get to those files under the windows GUI useless.
 
lockheed2266 said:
I have old files on accounts on the computer i am trying to get to, it is all my stuff, only person who uses the computer. i jsut need to obtain files from a user account, and resetting the account password would render the ability to get to those files under the windows GUI useless.
Click to expand...

Unless those files are encrypted there is no reason why you can't slave the hard drive into another computer and copy the files off. Even if you receive an "access denied" under XP/2000 you can take ownership and still retrieve the files *without* the need to crack the password.
 
even if you did blank out / change the password with a utility... since when does that prevent you from getting your files.
 
Cataclysmcow said:
There are many reasons why the OP or anyone else may not want to reset the password.
Click to expand...

Why?

IF he has forgotten the passwd then resetting makes no difference. IF it is not his tehn finding out the passwd provides them with untold advantages

But just incase:


Pentoo
THIS is what you want. Great for security reason's and secuirty reasons!!!
here is an overview
http://dev.gentoo.org/~vanquirius/pentoo_review.html

Knoppix is great IF you want a desktop, ie browse net, write a report, send emails, edit some pictures

BUT if you need a RO boot CD to check integraty of yr network it does not come much beter then this, comes with Nessus for starters

BUT the two utils of interest here are

1) NT passwd resetter, clears the passwd in a few seconds
2) John the ripper to crack the passwd, will take time based upon CPU speed, complexaty of passwd and luck
 
lockheed2266 said:
I have old files on accounts on the computer i am trying to get to, it is all my stuff, only person who uses the computer. i jsut need to obtain files from a user account, and resetting the account password would render the ability to get to those files under the windows GUI useless.
Click to expand...
You are wrong. You are incredibly wrong. Also, despite what SJConsultant said, any encryption on the files would still be okay to access, since the encryption certificate is not contingent on the user password you use to log in (trust me, I use it myself).

You need the files, own the folder and take them. It is that simple.
 
GreNME said:
You are wrong. You are incredibly wrong. Also, despite what SJConsultant said, any encryption on the files would still be okay to access, since the encryption certificate is not contingent on the user password you use to log in (trust me, I use it myself).
Click to expand...

That's dependent on the encryption used, if it is EFS, then yes there are ways to regain access. Many third party encryption utilities do not have "easy" or "quick" methods of recovery.
 
lockheed2266 said:
Hi, i have a simple question.

I need to get to an old computer i have that i have lost the password. I have tried to boot to a CD in linux (knoppix-STD) and MS-DOS, i am jsut having problems copying the sam file on the C:\ drive to a thumb drive. i know how to get the password once i get the SAM but i just need gelp copying the SAM from the C:\WINDOWS\system32\config folder.

Whats the command i would use to copy the file. in either MS-DOS or Knoppix-STD or PHLAK.

I am also unable to get standard knoppix to boot because it keeps going into DOS and i am burning with nero6, i am using Windows XP.

it jsut says A:\


Thank you for your help and time.

PS. This is my PC and there are no illeagal activity going on, thank you
Click to expand...

Have you burnt it as an image or did you put the ISO onto a CD as a datafile , it needs to be burnt as an image.

As to copy the command is "cp" but to where?

you could use the browser to find the file and copy it out using the GUI,
 
SJConsultant said:
That's dependent on the encryption used, if it is EFS, then yes there are ways to regain access. Many third party encryption utilities do not have "easy" or "quick" methods of recovery.
Click to expand...
But none of them are tied to the user logon. If the password is reset, it is still treated the same as before it was reset.
 
I have old files on accounts on the computer i am trying to get to, it is all my stuff, only person who uses the computer. i jsut need to obtain files from a user account, and resetting the account password would render the ability to get to those files under the windows GUI useless.
Click to expand...

WTF? I don't see how "resetting the account password would render the ability to get to those files under the windows GUI useless." :rolleyes:
 
"
WTF? I don't see how "resetting the account password would render the ability to get to those files under the windows GUI useless."

Because the old files are still encrypted with the EFS.
 
GreNME said:
But none of them are tied to the user logon. If the password is reset, it is still treated the same as before it was reset.
Click to expand...

Not true. In the case of EFS, forcefully resetting a user password essentially invalidates the encryption certificates when the user logs in with a new password.

Same way with my IBM laptop with third party encryption, if I forcefully reset my user account, I lose access to all files and security certificates.
 
SJConsultant said:
Not true. In the case of EFS, forcefully resetting a user password essentially invalidates the encryption certificates when the user logs in with a new password.

Same way with my IBM laptop with third party encryption, if I forcefully reset my user account, I lose access to all files and security certificates.
Click to expand...
With EFS, as long as you still have the certificate, you can reinstall it and access the files. Yes, you are forced to reinstall the certificate, but you had to create a certificate in the first place.

I still think he's lying.
 
SJConsultant said:
Not true. In the case of EFS, forcefully resetting a user password essentially invalidates the encryption certificates when the user logs in with a new password.

Same way with my IBM laptop with third party encryption, if I forcefully reset my user account, I lose access to all files and security certificates.
Click to expand...


acctually the Certificate is mapped to the SID of the user. Change the SID and this is correct.

Change the password through the EFS recovery or the password reset disk and EFS will still unencrpyt the files as the certificate is still mapped to the user. That is UNLESS you password protect the certificate storage also. Done it numerous times, every time an admin thinks he has pulled a fast one :)
 
GreNME said:
Then please, why not highlight some of those wonderful reasons for us? You see, all I can think of with the scant info and the general questions that have been asked so far are two things:
  1. Someone else still uses the computer, and the original poster doesn't want someone to know they have the password
  2. This is a school or work computer, and changing the admin password will alert the real administrators

If this is her/his own personal computer, then changing the password won't break anything, won't lose anything (except the old password), and gives access to the OS itself. Period.
Click to expand...

have to agree

there should be ZERO reason why OP can not reset password. It will not affect anything.
 
figgie said:
acctually the Certificate is mapped to the SID of the user. Change the SID and this is correct.

Change the password through the EFS recovery or the password reset disk and EFS will still unencrpyt the files as the certificate is still mapped to the user. That is UNLESS you password protect the certificate storage also. Done it numerous times, every time an admin thinks he has pulled a fast one :)
Click to expand...

Yes I know the recovery agent and reset disk will regain access to those files, however, from all the documentation I have read on MS website, not having either renders recovery much more difficult without third party utilities.
 
You must log in or register to reply here.
Back
Top