Finding Outlook Express password

[techidave]

I need some help in locating the OE password from a non booting hard drive.  I can see all the files on the hard drive when I slave it to my computer.  I have tried Nirsoft's MailPassView but it cannot see but the booting hard drive.

Is there a way that I can find this out?

thanks
dave

[40hz]

Google for RockXP and see if a copy of that will do it.
Luck.

[Carol Haynes]

RockXP doesn't seem to lookfor anything other than product keys and activation details for XP:

http://majorgeeks.com/RockXP_d4138.html

http://www.ubcd4win.com has some password recovery tools and can connect to non-booting windows xp registries. You may be able to recover the passwords from the registry in hashed format and recover them the one of the password tools.

Never tried this but worth a look:

http://www.technobuz...ok-express-password/

[PhilB66]

OutlookPasswordDecryptor - http://securityxplod...ookpassworddecryptor

[Carol Haynes]

OutlookPasswordDecryptor - http://securityxplod...ookpassworddecryptor

-PhilB66 (February 10, 2012, 07:53 PM)

Don't you have to have a working system to use that? Also it only seems to support Outlook account not Outlook Express (which isn't a version of Outlook at all) - though the comment that Outlook and OE store their passwords in similar registry locations may mean that it will do that.

[40hz]

RockXP doesn't seem to lookfor anything other than product keys and activation details for XP:

-Carol Haynes (February 10, 2012, 07:22 PM)

@C - You're right. I conflated it with the Nirsoft utility. Sorry. It's been been a long week.  

[techidave]

OutlookPasswordDecryptor - http://securityxplod...ookpassworddecryptor

-PhilB66 (February 10, 2012, 07:53 PM)

Don't you have to have a working system to use that? Also it only seems to support Outlook account not Outlook Express (which isn't a version of Outlook at all) - though the comment that Outlook and OE store their passwords in similar registry locations may mean that it will do that.

-Carol Haynes (February 11, 2012, 04:24 AM)

Well Carol, it looks like maybe it can fetch OE passwords. But I am not sure whether it can do it from a dead system.

It can recover passwords from all versions starting with Outlook Express to latest version, Outlook 2010 and works on wide range of platforms starting from Windows 2000 to Windows 7.

[Carol Haynes]

Did you try the one I mentioned above - for that all you need is access to the profile files on the old drive?

[Ath]

If you could open the registry files from that account, you could extract the (probably encrypted) password from there, put it in a new local OE-account with the same credentials and probably read the mail.
Then the NirSoft tool, mentioned above, could be used to capture the real password.

[4wd]

Did you try the one I mentioned above - for that all you need is access to the profile files on the old drive?

-Carol Haynes (February 11, 2012, 08:40 AM)

That seems to cost $28 which to save time and effort might be a bargain.
Then again, I'd be trying to exhaust all free methods before I got that far.......but I do have a lot of spare time

@techidave: If you can read the HDD, (Live CD, plug it in another computer), you can copy the registry files, (in C:\Windows\system32\config), to a flash drive or directory and then use the Load/Unload Hive feature of regedit to access the entries and try as Ath suggests above.  You might need to copy the relevant NTUSER.DAT also, as Carols link suggests.   Or you could just use Nirsoft' RegFileExport to export the registry entries in NTUSER.DAT so you can import them into a new account as Ath suggests.

If it were me, I'd probably image the drive, (or OS partition), and then perform a Repair-in-place which would fix the non-booting problem and should restore access to OE to run the Nirsoft tool.  That, for me, would be the simplest solution but it depends on how munged the system became before getting to the non-booting stage.

[widgewunner]

SIW will do it. Quick, easy and free!

Look under: SIW -> Software -> Passwords

(Edit: I see now that the info is not on your boot drive - may not work as expected...)