Common Recovery and Removal Questions - Revision history

Rwh: /* How Do I Clear A Windows XP User Password? */

2010-11-16T19:44:58Z

How Do I Clear A Windows XP User Password?

← Older revision		Revision as of 15:44, 16 November 2010
Line 5:		Line 5:

	* Mounting the Windows drive. This is typically going to be the first partition on a IDE or SATA hard disk (it will be ''/dev/sda1'' on 99% of the Windows XP systems you come across).		* Mounting the Windows drive. This is typically going to be the first partition on a IDE or SATA hard disk (it will be ''/dev/sda1'' on 99% of the Windows XP systems you come across).
	* Locating the ''SAM'' file (typically found under the ''WINDOWS/system32/config directory'' on a Windows XP box).		* Locating the ''[http://en.wikipedia.org/wiki/Security_Accounts_Manager Security Accounts Manager (SAM)]'' file (typically found under the ''WINDOWS/system32/config directory'' on a Windows XP box).
	* Running the '''chntpw''' command on the ''SAM'' file.		* Running the '''chntpw''' command on the ''SAM'' file.
	* Finally, its important to '''[http://wiki.linuxquestions.org/wiki/Umount umount]''' the Windows drive to make sure all data written to the ''SAM'' file is flushed to disk.		* Finally, its important to '''[http://wiki.linuxquestions.org/wiki/Umount umount]''' the Windows drive to make sure all data written to the ''SAM'' file is flushed to disk.

Rwh: /* How Do I Erase A Partition or Entire Disk? */

2010-11-16T19:42:39Z

How Do I Erase A Partition or Entire Disk?

← Older revision		Revision as of 15:42, 16 November 2010
Line 129:		Line 129:

	* You can use the '''[http://prowiki.isc.upenn.edu/wiki/Secure_Wipe/Delete_Utilities wipe]''' or '''[http://prowiki.isc.upenn.edu/wiki/Secure_Wipe/Delete_Utilities scrub]''' command line utility to thoroughly erase the data on the hard disk. However, this takes a VERY long time.		* You can use the '''[http://prowiki.isc.upenn.edu/wiki/Secure_Wipe/Delete_Utilities wipe]''' or '''[http://prowiki.isc.upenn.edu/wiki/Secure_Wipe/Delete_Utilities scrub]''' command line utility to thoroughly erase the data on the hard disk. However, this takes a VERY long time.
	* You can '''cat''' from ''/dev/zero'' to the hard disk or partition which you want to erase. This is a very quick way to erase the contents of the disk. However, there are those that believe that if one had the right equipment, it might be possible to recover data from a "zeroed" disk by looking at "lingering" magnetic charges left on the media.		* You can '''[http://en.wikipedia.org/wiki/Cat_%28Unix%29 cat]''' from ''/dev/zero'' to the hard disk or partition which you want to erase. This is a very quick way to erase the contents of the disk. However, there are those that believe that if one had the right equipment, it might be possible to recover data from a "zeroed" disk by looking at "lingering" magnetic charges left on the media.
	* You can '''cat''' from ''/dev/urandom'' to the hard disk or partition which you want to erase. This takes significantly longer than using ''/dev/zero''.		* You can '''cat''' from ''/dev/urandom'' to the hard disk or partition which you want to erase. This takes significantly longer than using ''/dev/zero''.

Rwh: /* How Do I Erase A Partition or Entire Disk? */

2010-11-16T19:41:30Z

How Do I Erase A Partition or Entire Disk?

← Older revision		Revision as of 15:41, 16 November 2010
Line 128:		Line 128:
	Maybe this topic shouldn't be under the area of recovery as its more of a ''anti-recovery'' issue. However, if you are getting ready to discard, or give away an old hard disk, its a good idea to clear the contents. There are several ways in which you can do this:		Maybe this topic shouldn't be under the area of recovery as its more of a ''anti-recovery'' issue. However, if you are getting ready to discard, or give away an old hard disk, its a good idea to clear the contents. There are several ways in which you can do this:

	* You can use the '''wipe''' or '''scrub''' command line utility to thoroughly erase the data on the hard disk. However, this takes a VERY long time.		* You can use the '''[http://prowiki.isc.upenn.edu/wiki/Secure_Wipe/Delete_Utilities wipe]''' or '''[http://prowiki.isc.upenn.edu/wiki/Secure_Wipe/Delete_Utilities scrub]''' command line utility to thoroughly erase the data on the hard disk. However, this takes a VERY long time.
	* You can '''cat''' from ''/dev/zero'' to the hard disk or partition which you want to erase. This is a very quick way to erase the contents of the disk. However, there are those that believe that if one had the right equipment, it might be possible to recover data from a "zeroed" disk by looking at "lingering" magnetic charges left on the media.		* You can '''cat''' from ''/dev/zero'' to the hard disk or partition which you want to erase. This is a very quick way to erase the contents of the disk. However, there are those that believe that if one had the right equipment, it might be possible to recover data from a "zeroed" disk by looking at "lingering" magnetic charges left on the media.
	* You can '''cat''' from ''/dev/urandom'' to the hard disk or partition which you want to erase. This takes significantly longer than using ''/dev/zero''.		* You can '''cat''' from ''/dev/urandom'' to the hard disk or partition which you want to erase. This takes significantly longer than using ''/dev/zero''.

Rwh: /* How Do I Clear A Windows XP User Password? */

2010-11-16T19:37:05Z

How Do I Clear A Windows XP User Password?

← Older revision		Revision as of 15:37, 16 November 2010
Line 7:		Line 7:
	* Locating the ''SAM'' file (typically found under the ''WINDOWS/system32/config directory'' on a Windows XP box).		* Locating the ''SAM'' file (typically found under the ''WINDOWS/system32/config directory'' on a Windows XP box).
	* Running the '''chntpw''' command on the ''SAM'' file.		* Running the '''chntpw''' command on the ''SAM'' file.
	* Finally, its important to '''umount''' the Windows drive to make sure all data written to the ''SAM'' file is flushed to disk.		* Finally, its important to '''[http://wiki.linuxquestions.org/wiki/Umount umount]''' the Windows drive to make sure all data written to the ''SAM'' file is flushed to disk.

	[[File:Warning.png\|16px]] We have not encountered a problem using the '''chntpw''' utility. However, as it involves writing to a Windows NTFS partition, it makes Paul nervous each time he uses it (and he's pretty sure that he's had to re-install Windows at least once after using this utility). If the Windows box is important you should back up any data PRIOR to using this command.		[[File:Warning.png\|16px]] We have not encountered a problem using the '''chntpw''' utility. However, as it involves writing to a Windows NTFS partition, it makes Paul nervous each time he uses it (and he's pretty sure that he's had to re-install Windows at least once after using this utility). If the Windows box is important you should back up any data PRIOR to using this command.

Rwh at 19:08, 16 November 2010

2010-11-16T19:08:46Z

← Older revision		Revision as of 15:08, 16 November 2010
Line 1:		Line 1:
			__TOC__
	= How Do I Clear A Windows XP User Password? =		= How Do I Clear A Windows XP User Password? =

Rwh: /* How Do I Clear A Windows XP User Password? */

2010-11-16T19:06:30Z

How Do I Clear A Windows XP User Password?

← Older revision		Revision as of 15:06, 16 November 2010
Line 1:		Line 1:
	= How Do I Clear A Windows XP User Password? =		= How Do I Clear A Windows XP User Password? =

	The Network Security Toolkit distribution contains the necessary tools to allow one to reset a forgotten user password on a Windows XP drive. This is done via the '''chntpw''' utility. The process involves the following:		The Network Security Toolkit distribution contains the necessary tools to allow one to reset a forgotten user password on a Windows XP drive. This is done via the '''[http://en.wikipedia.org/wiki/Chntpw chntpw]''' utility. The process involves the following:

	* Mounting the Windows drive. This is typically going to be the first partition on a IDE or SATA hard disk (it will be ''/dev/sda1'' on 99% of the Windows XP systems you come across).		* Mounting the Windows drive. This is typically going to be the first partition on a IDE or SATA hard disk (it will be ''/dev/sda1'' on 99% of the Windows XP systems you come across).
Line 121:		Line 121:
	/mnt/win/Windows/System32/config/SAM		/mnt/win/Windows/System32/config/SAM
	[root@cayenne ~]# umount /mnt/win		[root@cayenne ~]# umount /mnt/win
	[root@cayenne ~]#		[root@cayenne ~]#

	= How Do I Erase A Partition or Entire Disk? =		= How Do I Erase A Partition or Entire Disk? =

Paul Blankenbaker: Created page with '= How Do I Clear A Windows XP User Password? = The Network Security Toolkit distribution contains the necessary tools to allow one to reset a forgotten user password on a Window…'

2010-11-05T11:01:43Z

Created page with '= How Do I Clear A Windows XP User Password? = The Network Security Toolkit distribution contains the necessary tools to allow one to reset a forgotten user password on a Window…'

New page

= How Do I Clear A Windows XP User Password? =

The Network Security Toolkit distribution contains the necessary tools to allow one to reset a forgotten user password on a Windows XP drive. This is done via the '''chntpw''' utility. The process involves the following:

* Mounting the Windows drive. This is typically going to be the first partition on a IDE or SATA hard disk (it will be ''/dev/sda1'' on 99% of the Windows XP systems you come across).
* Locating the ''SAM'' file (typically found under the ''WINDOWS/system32/config directory'' on a Windows XP box).
* Running the '''chntpw''' command on the ''SAM'' file.
* Finally, its important to '''umount''' the Windows drive to make sure all data written to the ''SAM'' file is flushed to disk.

[[File:Warning.png|16px]] We have not encountered a problem using the '''chntpw''' utility. However, as it involves writing to a Windows NTFS partition, it makes Paul nervous each time he uses it (and he's pretty sure that he's had to re-install Windows at least once after using this utility). If the Windows box is important you should back up any data PRIOR to using this command.

First, lets mount the Windows XP disk and list what users are on the system.

[root@probe ~]# mkdir /mnt/winxp
[root@probe ~]# mount /dev/sda1 /mnt/winxp
[root@probe ~]# ls /mnt/winxp/WINDOWS/system32/config
AppEvent.Evt SAM SECURITY.LOG SysEvent.Evt system.sav
default SAM.LOG software system TempKey.LOG
default.LOG SecEvent.Evt software.LOG system.LOG userdiff
default.sav SECURITY software.sav systemprofile userdiff.LOG
[root@probe ~]# chntpw -l /mnt/winxp/WINDOWS/system32/config/SAM
chntpw version 0.99.3 040818, (c) Petter N Hagen
Hive's name (from header): <\SystemRoot\System32\Config\SAM>
ROOT KEY at offset: 0x001020 * Subkey indexing type is: 666c <lf>
Page at 0x7000 is not 'hbin', assuming file contains garbage at end
File size 262144 [40000] bytes, containing 6 pages (+ 1 headerpage)
Used for data: 270/21264 blocks/bytes, unused: 7/3120 blocks/bytes.

* SAM policy limits:
Failed logins before lockout is: 0
Minimum password length : 0
Password history count : 0
RID: 01f4, Username: <Administrator>, *disabled or locked*
RID: 03ed, Username: <erik>, *BLANK password*
RID: 01f5, Username: <Guest>, *disabled or locked*
RID: 03e8, Username: <HelpAssistant>, *disabled or locked*
RID: 03ec, Username: <megan>
RID: 03eb, Username: <pkb>
RID: 03ee, Username: <scott>, *disabled or locked*
RID: 03ea, Username: <SUPPORT_388945a0>, *disabled or locked*

Hives that have changed:
# Name
None!
[root@probe ~]#

Now that we've identified the users on the system, lets clear the password for ''scott'':

[root@probe ~]# chntpw -u scott /mnt/winxp/WINDOWS/system32/config/SAM
chntpw version 0.99.3 040818, (c) Petter N Hagen
Hive's name (from header): <\SystemRoot\System32\Config\SAM>
ROOT KEY at offset: 0x001020 * Subkey indexing type is: 666c <lf>
Page at 0x7000 is not 'hbin', assuming file contains garbage at end
File size 262144 [40000] bytes, containing 6 pages (+ 1 headerpage)
Used for data: 270/21264 blocks/bytes, unused: 7/3120 blocks/bytes.

* SAM policy limits:
Failed logins before lockout is: 0
Minimum password length : 0
Password history count : 0
RID: 01f4, Username: <Administrator>, *disabled or locked*
RID: 03ed, Username: <erik>, *BLANK password*
RID: 01f5, Username: <Guest>, *disabled or locked*
RID: 03e8, Username: <HelpAssistant>, *disabled or locked*
RID: 03ec, Username: <megan>
RID: 03eb, Username: <pkb>
RID: 03ee, Username: <scott>, *disabled or locked*
RID: 03ea, Username: <SUPPORT_388945a0>, *disabled or locked*

---------------------> SYSKEY CHECK <-----------------------
SYSTEM SecureBoot : -1 -> Not Set (not installed, good!)
SAM Account\F : 0 -> off
SECURITY PolSecretEncryptionKey: -1 -> Not Set (OK if this is NT4)
Syskey not installed!
RID : 1006 [03ee]
Username: scott
fullname:
comment :
homedir :

Account bits: 0x0210 =
[ ] Disabled | [ ] Homedir req. | [ ] Passwd not req. |
[ ] Temp. duplicate | [X] Normal account | [ ] NMS account |
[ ] Domain trust ac | [ ] Wks trust act. | [ ] Srv trust act |
[X] Pwd don't expir | [ ] Auto lockout | [ ] (unknown 0x08) |
[ ] (unknown 0x10) | [ ] (unknown 0x20) | [ ] (unknown 0x40) |

Failed login count: 3, while max tries is: 0
Total login count: 19
Account is probably locked out!
Do you wish me to reset the failed count, unset disabled and lockout,
and set the "password never expires" option? (y/n) [n]y

* = blank the password (This may work better than setting a new password!)
Enter nothing to leave it unchanged
Please enter new password: *
Blanking password!

Do you really wish to change it? (y/n) [n] y
Changed!

Hives that have changed:
# Name
0 </mnt/winxp/WINDOWS/system32/config/SAM>
Write hive files? (y/n) [n] : y
writeHive: write of /mnt/winxp/WINDOWS/system32/config/SAM failed: Success.

[root@probe ~]# umount /mnt/winxp
[root@probe ~]#

[[File:Warning.png|16px]] We aren't sure why the "failed" messages occur at the end of the output.

The example above was run on a Windows XP 32 bit system, if the system you are using is not running Windows XP, the ''SAM'' file may be in a different directory. You can use the '''find''' command to locate the file. Here is a example of locating the ''SAM'' file on a Windows 7 32 bit machine:

[root@cayenne ~]# mkdir /mnt/win
[root@cayenne ~]# mount /dev/sda1 /mnt/win
[root@cayenne ~]# find /mnt/win/Windows -name SAM
/mnt/win/Windows/System32/config/RegBack/SAM
/mnt/win/Windows/System32/config/SAM
[root@cayenne ~]# umount /mnt/win
[root@cayenne ~]#

= How Do I Erase A Partition or Entire Disk? =

Maybe this topic shouldn't be under the area of recovery as its more of a ''anti-recovery'' issue. However, if you are getting ready to discard, or give away an old hard disk, its a good idea to clear the contents. There are several ways in which you can do this:

* You can use the '''wipe''' or '''scrub''' command line utility to thoroughly erase the data on the hard disk. However, this takes a VERY long time.
* You can '''cat''' from ''/dev/zero'' to the hard disk or partition which you want to erase. This is a very quick way to erase the contents of the disk. However, there are those that believe that if one had the right equipment, it might be possible to recover data from a "zeroed" disk by looking at "lingering" magnetic charges left on the media.
* You can '''cat''' from ''/dev/urandom'' to the hard disk or partition which you want to erase. This takes significantly longer than using ''/dev/zero''.

Whichever method you choose, remember to allow plenty of time as event the quickest method may take a minute or more per GB of disk. Also, external hard disks tend to take significantly longer to clear than internal hard disks. If you are able to remove a external hard disk from its enclosure and mount it internally on a system, you may speed up the process significantly.

The following examples demonstrate how one might erase the entire contents of the hard disk mapped to ''/dev/sda''.

[[File:Warning.png|16px]] '''DO NOT''' run any of the commands shown below if you have any important data left on your hard drive. These commands ''clear everything'' (including your partition tables).

The following provides some examples of erasing a very old '''16 MB''' (notice ''MB'' not ''GB'') SD flash card which appears as disk ''/dev/sdb'' to the system. The ''time'' command was used to show how long each method took and while its not a good measurement for the times to expect on your system (this SD card was not the fastest), it does give an idea of the relative time difference between each method.

Information about ''/dev/sdb'':

[root@cayenne ~]# fdisk -l /dev/sdb

Disk /dev/sdb: 16 MB, 16056320 bytes
2 heads, 32 sectors/track, 490 cylinders
Units = cylinders of 64 * 512 = 32768 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x00000000

Device Boot Start End Blocks Id System
/dev/sdb1 1 490 15651+ 1 FAT12
[root@cayenne ~]#

Using the '''wipe''' command:

[root@probe ~]# time (wipe /dev/sdb; sync)
Okay to WIPE 1 special file ? (Yes/No) Yes
Operation finished.
1 file wiped and 0 special files ignored in 0 directories, 0 symlinks removed but not followed, 0 errors occured.

real 14m1.267s
user 0m4.052s
sys 0m5.269s
[root@probe ~]#

Using the '''scrub''' command:

[root@probe ~]# time (scrub /dev/sdb; sync)
scrub: using NNSA NAP-14.x patterns
scrub: please verify that device size below is correct!
scrub: scrubbing /dev/sdb 16056320 bytes (~15MB)
scrub: random |................................................|
scrub: random |................................................|
scrub: 0x00 |................................................|
scrub: verify |................................................|

real 1m22.839s
user 0m1.564s
sys 0m0.413s
[root@probe ~]#

Copying ''/dev/urandom'' to disk method:

[root@probe ~]# time (cat < /dev/urandom > /dev/sdb; sync)
cat: write error: No space left on device

real 0m33.885s
user 0m0.001s
sys 0m9.500s
[root@probe ~]#

Copying ''/dev/zero'' to disk method:

[root@probe ~]# time cat < /dev/zero > /dev/sdb
cat: write error: No space left on device

real 0m23.168s
user 0m0.001s
sys 0m0.154s
[root@probe ~]#