Home | Blog | Software | Reviews and Features | Forum | Help | Donate | About us
topbanner_forum
  *

avatar image

Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
  • December 03, 2016, 05:35:40 AM
  • Proudly celebrating 10 years online.
  • Donate now to become a lifetime supporting member of the site and get a non-expiring license key for all of our programs.
  • donate

Author Topic: Reading Administrator account files from USB  (Read 3177 times)

PPLandry

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 694
    • View Profile
    • InfoQube Information manager
    • Read more about this member.
    • Donate to Member
Reading Administrator account files from USB
« on: September 22, 2008, 08:44:07 PM »
My notebook HD started to freak out 2 months ago and decided to change it before it was too late. I backup up stuff from my usual Windows account (not the Administrator account) to an external drive, swapped the old drive for a new one and reinstalled everything. It is working just fine now.

I also put the old HD into an enclosure as it is still functional. My question is:

- I had some file in the Administrator account. When I connect the USB drive, those file are not visible. In fact, the whole Documents and Settings\Administrator folder structure is read protected (Access is denied). How can I access those files, other than putting that HD back into the notebook? Can I be prompted to enter an account/password to access the files? Can I take ownership of those files?

Nothing that critical there, just some old files I had before creating my usual Windows account, mostly in very old backups I could dig up, but just to be sure that I have all backups, I'd like to actually see what was there...


Thanks
Real generosity toward the future lies in giving all to the present -- Albert Camus -- www.InfoQube.biz

Ehtyar

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 1,237
    • View Profile
    • Donate to Member
Re: Reading Administrator account files from USB
« Reply #1 on: September 22, 2008, 09:15:52 PM »
I've had to do a similar thing myself. Follow the instructions here to take ownership of the folder.

Ehtyar.

PPLandry

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 694
    • View Profile
    • InfoQube Information manager
    • Read more about this member.
    • Donate to Member
Re: Reading Administrator account files from USB
« Reply #2 on: September 22, 2008, 10:18:16 PM »
Thanks!  :up: :up:
Real generosity toward the future lies in giving all to the present -- Albert Camus -- www.InfoQube.biz

Shades

  • Member
  • Joined in 2006
  • **
  • Posts: 2,096
    • View Profile
    • Donate to Member
Re: Reading Administrator account files from USB
« Reply #3 on: September 24, 2008, 07:34:31 PM »
If it is looking that you want, a method that will work is booting from a Linux Live CD (or their USB version). Linux does not know/care about Windows policies/ownership etc.

Likely you can even strip all that kind NTFS info from a file when storing it on a non-NTFS filesystem and copy the copy to your new system.

Ehtyar

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 1,237
    • View Profile
    • Donate to Member
Re: Reading Administrator account files from USB
« Reply #4 on: September 24, 2008, 07:37:22 PM »
If it is looking that you want, a method that will work is booting from a Linux Live CD (or their USB version). Linux does not know/care about Windows policies/ownership etc.

Likely you can even strip all that kind NTFS info from a file when storing it on a non-NTFS filesystem and copy the copy to your new system.
Indeed this is a much better solution for covert forensics.

Ehtyar.

PPLandry

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 694
    • View Profile
    • InfoQube Information manager
    • Read more about this member.
    • Donate to Member
Re: Reading Administrator account files from USB
« Reply #5 on: September 24, 2008, 11:01:49 PM »
I was able to take ownership of some other account files and this without ever being asked a password... what kind of security is that? What is the point of setting access priviledges to files, if anybody can simply bypass this and simple take ownership?

I'm happy to have been able to do it, but at the very least, I expected to be required to enter the original account credentials (account name, password), otherwise NTFS security is just a joke...
Real generosity toward the future lies in giving all to the present -- Albert Camus -- www.InfoQube.biz

Ehtyar

  • Supporting Member
  • Joined in 2007
  • **
  • Posts: 1,237
    • View Profile
    • Donate to Member
Re: Reading Administrator account files from USB
« Reply #6 on: September 25, 2008, 12:37:53 AM »
User accounts are not encrypted by default. This is an option you have to set in the user control panel. The algorithm used is fully secure as far as I am aware.

Ehtyar.

mwb1100

  • Supporting Member
  • Joined in 2006
  • **
  • Posts: 1,520
    • View Profile
    • Donate to Member
Re: Reading Administrator account files from USB
« Reply #7 on: September 25, 2008, 12:59:38 AM »
I was able to take ownership of some other account files and this without ever being asked a password... what kind of security is that? What is the point of setting access priviledges to files, if anybody can simply bypass this and simple take ownership?

I'm happy to have been able to do it, but at the very least, I expected to be required to enter the original account credentials (account name, password), otherwise NTFS security is just a joke...
I assume that you are running with an administrator account on the new machine?  Administrators have the right to take ownership of files.  If you were logged on as a non-admin user, you would not have been able to do this.

thorazine74

  • Participant
  • Joined in 2008
  • *
  • default avatar
  • Posts: 11
    • View Profile
    • Donate to Member
Re: Reading Administrator account files from USB
« Reply #8 on: September 25, 2008, 08:06:19 AM »
If you are in Vista you can use this registry hack to add a context menu entry that will execute all the commands to gain access to the locked folder in just one click:

http://www.howtogeek...ds/TakeOwnership.zip

Take from this page: http://www.howtogeek...click-menu-in-vista/