Common Recovery and Removal Questions

How Do I Clear A Windows XP User Password?

The Network Security Toolkit distribution contains the necessary tools to allow one to reset a forgotten user password on a Windows XP drive. This is done via the chntpw utility. The process involves the following:

• Mounting the Windows drive. This is typically going to be the first partition on a IDE or SATA hard disk (it will be /dev/sda1 on 99% of the Windows XP systems you come across).
• Locating the SAM file (typically found under the WINDOWS/system32/config directory on a Windows XP box).
• Running the chntpw command on the SAM file.
• Finally, its important to umount the Windows drive to make sure all data written to the SAM file is flushed to disk.

We have not encountered a problem using the chntpw utility. However, as it involves writing to a Windows NTFS partition, it makes Paul nervous each time he uses it (and he's pretty sure that he's had to re-install Windows at least once after using this utility). If the Windows box is important you should back up any data PRIOR to using this command.

First, lets mount the Windows XP disk and list what users are on the system.

[root@probe ~]# mkdir /mnt/winxp
[root@probe ~]# mount /dev/sda1 /mnt/winxp
[root@probe ~]# ls /mnt/winxp/WINDOWS/system32/config
AppEvent.Evt  SAM           SECURITY.LOG  SysEvent.Evt   system.sav
default       SAM.LOG       software      system         TempKey.LOG
default.LOG   SecEvent.Evt  software.LOG  system.LOG     userdiff
default.sav   SECURITY      software.sav  systemprofile  userdiff.LOG
[root@probe ~]# chntpw -l /mnt/winxp/WINDOWS/system32/config/SAM
chntpw version 0.99.3 040818, (c) Petter N Hagen
Hive's name (from header): <\SystemRoot\System32\Config\SAM>
ROOT KEY at offset: 0x001020 * Subkey indexing type is: 666c <lf>
Page at 0x7000 is not 'hbin', assuming file contains garbage at end
File size 262144 [40000] bytes, containing 6 pages (+ 1 headerpage)
Used for data: 270/21264 blocks/bytes, unused: 7/3120 blocks/bytes. 

* SAM policy limits:
Failed logins before lockout is: 0
Minimum password length        : 0
Password history count         : 0
RID: 01f4, Username: <Administrator>, *disabled or locked*
RID: 03ed, Username: <erik>, *BLANK password*
RID: 01f5, Username: <Guest>, *disabled or locked*
RID: 03e8, Username: <HelpAssistant>, *disabled or locked*
RID: 03ec, Username: <megan>
RID: 03eb, Username: <pkb>
RID: 03ee, Username: <scott>, *disabled or locked*
RID: 03ea, Username: <SUPPORT_388945a0>, *disabled or locked*

Hives that have changed:
 #  Name
None!
[root@probe ~]# 

Now that we've identified the users on the system, lets clear the password for scott:

[root@probe ~]# chntpw -u scott /mnt/winxp/WINDOWS/system32/config/SAM
chntpw version 0.99.3 040818, (c) Petter N Hagen
Hive's name (from header): <\SystemRoot\System32\Config\SAM>
ROOT KEY at offset: 0x001020 * Subkey indexing type is: 666c <lf>
Page at 0x7000 is not 'hbin', assuming file contains garbage at end
File size 262144 [40000] bytes, containing 6 pages (+ 1 headerpage)
Used for data: 270/21264 blocks/bytes, unused: 7/3120 blocks/bytes.

* SAM policy limits:
Failed logins before lockout is: 0
Minimum password length        : 0
Password history count         : 0
RID: 01f4, Username: <Administrator>, *disabled or locked*
RID: 03ed, Username: <erik>, *BLANK password*
RID: 01f5, Username: <Guest>, *disabled or locked*
RID: 03e8, Username: <HelpAssistant>, *disabled or locked*
RID: 03ec, Username: <megan>
RID: 03eb, Username: <pkb>
RID: 03ee, Username: <scott>, *disabled or locked*
RID: 03ea, Username: <SUPPORT_388945a0>, *disabled or locked*

---------------------> SYSKEY CHECK <-----------------------
SYSTEM   SecureBoot            : -1 -> Not Set (not installed, good!)
SAM      Account\F             : 0 -> off
SECURITY PolSecretEncryptionKey: -1 -> Not Set (OK if this is NT4)
Syskey not installed!
RID     : 1006 [03ee]
Username: scott
fullname: 
comment : 
homedir : 

Account bits: 0x0210 =
[ ] Disabled        | [ ] Homedir req.    | [ ] Passwd not req. | 
[ ] Temp. duplicate | [X] Normal account  | [ ] NMS account     | 
[ ] Domain trust ac | [ ] Wks trust act.  | [ ] Srv trust act   | 
[X] Pwd don't expir | [ ] Auto lockout    | [ ] (unknown 0x08)  | 
[ ] (unknown 0x10)  | [ ] (unknown 0x20)  | [ ] (unknown 0x40)  | 

Failed login count: 3, while max tries is: 0
Total  login count: 19
Account is probably locked out!
Do you wish me to reset the failed count, unset disabled and lockout,
and set the "password never expires" option? (y/n) [n]y


* = blank the password (This may work better than setting a new password!)
Enter nothing to leave it unchanged
Please enter new password: *
Blanking password!

Do you really wish to change it? (y/n) [n] y
Changed!


Hives that have changed:
 #  Name
 0  </mnt/winxp/WINDOWS/system32/config/SAM>
Write hive files? (y/n) [n] : y
writeHive: write of /mnt/winxp/WINDOWS/system32/config/SAM failed: Success. 

[root@probe ~]# umount /mnt/winxp
[root@probe ~]# 

We aren't sure why the "failed" messages occur at the end of the output.

The example above was run on a Windows XP 32 bit system, if the system you are using is not running Windows XP, the SAM file may be in a different directory. You can use the find command to locate the file. Here is a example of locating the SAM file on a Windows 7 32 bit machine:

[root@cayenne ~]# mkdir /mnt/win
[root@cayenne ~]# mount /dev/sda1 /mnt/win
[root@cayenne ~]# find /mnt/win/Windows -name SAM
/mnt/win/Windows/System32/config/RegBack/SAM
/mnt/win/Windows/System32/config/SAM
[root@cayenne ~]# umount /mnt/win
[root@cayenne ~]#

How Do I Erase A Partition or Entire Disk?

Maybe this topic shouldn't be under the area of recovery as its more of a anti-recovery issue. However, if you are getting ready to discard, or give away an old hard disk, its a good idea to clear the contents. There are several ways in which you can do this:

• You can use the wipe or scrub command line utility to thoroughly erase the data on the hard disk. However, this takes a VERY long time.
• You can cat from /dev/zero to the hard disk or partition which you want to erase. This is a very quick way to erase the contents of the disk. However, there are those that believe that if one had the right equipment, it might be possible to recover data from a "zeroed" disk by looking at "lingering" magnetic charges left on the media.
• You can cat from /dev/urandom to the hard disk or partition which you want to erase. This takes significantly longer than using /dev/zero.

Whichever method you choose, remember to allow plenty of time as event the quickest method may take a minute or more per GB of disk. Also, external hard disks tend to take significantly longer to clear than internal hard disks. If you are able to remove a external hard disk from its enclosure and mount it internally on a system, you may speed up the process significantly.

The following examples demonstrate how one might erase the entire contents of the hard disk mapped to /dev/sda.

DO NOT run any of the commands shown below if you have any important data left on your hard drive. These commands clear everything (including your partition tables).

The following provides some examples of erasing a very old 16 MB (notice MB not GB) SD flash card which appears as disk /dev/sdb to the system. The time command was used to show how long each method took and while its not a good measurement for the times to expect on your system (this SD card was not the fastest), it does give an idea of the relative time difference between each method.

Information about /dev/sdb:

[root@cayenne ~]# fdisk -l /dev/sdb

Disk /dev/sdb: 16 MB, 16056320 bytes
2 heads, 32 sectors/track, 490 cylinders
Units = cylinders of 64 * 512 = 32768 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1               1         490       15651+   1  FAT12
[root@cayenne ~]# 

Using the wipe command:

[root@probe ~]# time (wipe /dev/sdb; sync)
Okay to WIPE 1 special file ? (Yes/No) Yes
Operation finished.                                                           
1 file wiped and 0 special files ignored in 0 directories, 0 symlinks removed but not followed, 0 errors occured.

real	14m1.267s
user	0m4.052s
sys	0m5.269s
[root@probe ~]# 

Using the scrub command:

[root@probe ~]# time (scrub /dev/sdb; sync)
scrub: using NNSA NAP-14.x patterns
scrub: please verify that device size below is correct!
scrub: scrubbing /dev/sdb 16056320 bytes (~15MB)
scrub: random  |................................................|
scrub: random  |................................................|
scrub: 0x00    |................................................|
scrub: verify  |................................................|

real	1m22.839s
user	0m1.564s
sys	0m0.413s
[root@probe ~]# 

Copying /dev/urandom to disk method:

[root@probe ~]# time (cat < /dev/urandom > /dev/sdb; sync)
cat: write error: No space left on device

real	0m33.885s
user	0m0.001s
sys	0m9.500s
[root@probe ~]#

Copying /dev/zero to disk method:

[root@probe ~]# time cat < /dev/zero > /dev/sdb
cat: write error: No space left on device

real	0m23.168s
user	0m0.001s
sys	0m0.154s
[root@probe ~]#