Reading Administrator account files from USB

[PPLandry]

My notebook HD started to freak out 2 months ago and decided to change it before it was too late. I backup up stuff from my usual Windows account (not the Administrator account) to an external drive, swapped the old drive for a new one and reinstalled everything. It is working just fine now.

I also put the old HD into an enclosure as it is still functional. My question is:

- I had some file in the Administrator account. When I connect the USB drive, those file are not visible. In fact, the whole Documents and Settings\Administrator folder structure is read protected (Access is denied). How can I access those files, other than putting that HD back into the notebook? Can I be prompted to enter an account/password to access the files? Can I take ownership of those files?

Nothing that critical there, just some old files I had before creating my usual Windows account, mostly in very old backups I could dig up, but just to be sure that I have all backups, I'd like to actually see what was there...


Thanks

[Ehtyar]

I've had to do a similar thing myself. Follow the instructions here to take ownership of the folder.

Ehtyar.

[PPLandry]

Thanks! 

[Shades]

If it is looking that you want, a method that will work is booting from a Linux Live CD (or their USB version). Linux does not know/care about Windows policies/ownership etc.

Likely you can even strip all that kind NTFS info from a file when storing it on a non-NTFS filesystem and copy the copy to your new system.

[Ehtyar]

If it is looking that you want, a method that will work is booting from a Linux Live CD (or their USB version). Linux does not know/care about Windows policies/ownership etc.

Likely you can even strip all that kind NTFS info from a file when storing it on a non-NTFS filesystem and copy the copy to your new system.

Indeed this is a much better solution for covert forensics.

Ehtyar.

[PPLandry]

I was able to take ownership of some other account files and this without ever being asked a password... what kind of security is that? What is the point of setting access priviledges to files, if anybody can simply bypass this and simple take ownership?

I'm happy to have been able to do it, but at the very least, I expected to be required to enter the original account credentials (account name, password), otherwise NTFS security is just a joke...

[Ehtyar]

User accounts are not encrypted by default. This is an option you have to set in the user control panel. The algorithm used is fully secure as far as I am aware.

Ehtyar.

[mwb1100]

I was able to take ownership of some other account files and this without ever being asked a password... what kind of security is that? What is the point of setting access priviledges to files, if anybody can simply bypass this and simple take ownership?

I'm happy to have been able to do it, but at the very least, I expected to be required to enter the original account credentials (account name, password), otherwise NTFS security is just a joke...

I assume that you are running with an administrator account on the new machine?  Administrators have the right to take ownership of files.  If you were logged on as a non-admin user, you would not have been able to do this.

[thorazine74]

If you are in Vista you can use this registry hack to add a context menu entry that will execute all the commands to gain access to the locked folder in just one click:

http://www.howtogeek.com/downloads/TakeOwnership.zip

Take from this page: http://www.howtogeek.com/howto/windows-vista/add-take-ownership-to-explorer-right-click-menu-in-vista/