XP Home Notebook HD fails to boot, can't copy Private files

[Guest]

My notebook hard drive failed and will not boot XP via last working config,
safe mode, etc.

I can copy the files from the drive if I hook it up as a slave, but the
private files remain inaccessible. Is there anything I can do? I know the
user name and password of the protected account -- it is one of two admin
accounts on the drive.

Are there unprotected files on the drive that I could copy onto the new
drive that would allow me to read the protected files? ANYTHING would help!

 

[Nepatsfan]

(e-mail address removed),

My notebook hard drive failed and will not boot XP via last
working config, safe mode, etc.

I can copy the files from the drive if I hook it up as a
slave, but the private files remain inaccessible. Is there
anything I can do? I know the user name and password of the
protected account -- it is one of two admin accounts on the
drive.

Are there unprotected files on the drive that I could copy
onto the new drive that would allow me to read the protected
files? ANYTHING would help!

You need to disable Simple File Sharing and take ownership of
the files. Take a look at these articles for more info:

How to disable simplified sharing and set permissions on a
shared folder in Windows XP
http://support.microsoft.com/kb/307874/

How to take ownership of a file or folder in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308421

"Access is Denied" Error Message When You Try to Open a Folder
http://support.microsoft.com/kb/810881

Note: If you are running Microsoft Windows XP Home Edition, you
must start the computer in safe mode, and then log on with an
account that has Administrative rights to have access to the
Security tab. To start in Safe Mode, reboot your computer and
start tapping the F8 key as soon as you see anything displayed
on the screen. Keep hitting F8 until the Advanced Startup
Options menu appears. Use the up and down arrow keys on your
keyboard to select Safe Mode. Hit Enter.

Good luck

Nepatsfan

 

[Guest]

Have you tried to do a "System Restore"? This should be the next step as the
hard disk is still working.

 

[Guest]

As I said, I cannot boot it in safe mode either. I can only connect it via
IDE cable as a second hard drive to a desktop system. Any keys that written
to the failed drive have to be accessible. If all of the crypto files are
intact, what does it take to use them to read and copy the data? Is it even
possible to use that data if the operating system isn't running from the
drive? For that matter, can I even run a system restore on the drive if the
operating system isn't running on it?

I'm going to look more closely at the articles, but I'm assuming from your
note that I have to boot in safe mode applies to all.

 

[Guest]

I have not tried because I can't boot the drive in any fashion. If I hook up
the drive to a desktop as a slave then I can read the files but not the
private ones. I don't think that I can run a system restore if the system
being restored isn't running (ie a different system would be reading the
files).

It's an interesting approach if it would work, but I'll seek confirmation
first that I won't further fry the drive or overwrite the other system (if I
even got that far). Thanks regardless.

 

[Malke]

I have not tried because I can't boot the drive in any fashion. If I
hook up the drive to a desktop as a slave then I can read the files
but not the
private ones. I don't think that I can run a system restore if the
system being restored isn't running (ie a different system would be
reading the files).

It's an interesting approach if it would work, but I'll seek
confirmation first that I won't further fry the drive or overwrite the
other system (if I
even got that far). Thanks regardless.

You can't do a System Restore on a drive that won't boot. Here is
general data recovery information:

*IMPORTANT* - If there is any question that the drive is at fault - it's
making noises for instance - and the data is crucial DO NOTHING FURTHER
ON THE DRIVE. Every time you spin that drive up you may be destroying
data. If this is the case, send the drive to a professional data
recovery company like Drive Savers (my preference) or Seagate Data
Recovery. General prices run from $500USD on up. Drive Savers recovered
all the data on a failed laptop drive for one of my clients and it cost
$2,700. He thought it was worth the money; only you know what your data
is worth. I understand that some insurance companies are now covering
data recovery charges under "Loss of Intellectual Property" so check
with yours.

Drive Savers - http://www.drivesavers.com
Seagate Data Recovery Services - https://www.seagatedatarecovery.com/

*IMPORTANT* - If you think the drive is physically healthy, it may be
possible to retrieve the data by software methods. DO NOTHING FURTHER
ON THE DRIVE. The data is still on the hard drive but if you overwrite
it, it will be extremely difficult or impossible to recover it. If you
use data recovery software, install it on another machine and either
use it from that operating system or create a bootable cd/floppy and
work with that.

So, here are some things to try to recover your data:

1. Boot the target computer with either a Bart's PE or a Linux live cd
such as Knoppix and retrieve the data that way. Here is information on
using Knoppix for this:

You will need a computer with two cd drives, one of which is a cd/dvd-rw
OR a usb thumb drive with enough capacity to hold your data OR an
external usb/firewire hard drive formatted FAT32 (not NTFS). To get
Knoppix, you need a computer with a fast Internet connection and
third-party burning software. Download the Knoppix .iso and create your
bootable cd. Then boot with it and it will be able to see the Windows
files. If you are using the usb thumb drive or the external hard drive,
right-click on its icon (on the Desktop) to get its properties and
uncheck the box that says "Read Only". Then click on it to open it.
Note that the default mouse action in the window manager used by
Knoppix (KDE) is a single click to open instead of the traditional MS
Windows' double-click. Otherwise, use the K3b burning program to burn
the files to cd/dvd-r's.

http://www.knoppix.net
http://www.nu2.nu/pebuilder/ - Bart's PE Builder

2. If the target computer is a laptop or you don't have an external hard
drive or usb thumb drive (or the machine has other hardware problems
and won't boot), you can pull the drive and slave it in a computer
running a working install of XP. Depending on the target drive's
characteristics, you may need a drive adapter; i.e., laptop-to-IDE or a
SATA controller card, etc. Use the working Windows Explorer to copy the
data to the rescue system's hard drive. Often XP will not boot with a
slaved drive that has a damaged file system. In that case, boot your
rescue system with a Bart's PE or Knoppix cd.

3. If a Bart's PE or Knoppix won't work, you can try using data recovery
software. Here are some links to various programs. I use Easy Recovery
Pro, but it is expensive. People whom I respect have recommended
R-Studio and Restoration. YMMV.

http://www3.telus.net/mikebike/RESTORATION.html
PCInspector File Recovery -
http://www.pcinspector.de/file_recovery/welcome.htm
Executive Software “Undelete†-
http://www.execsoft.com/undelete/undelete.asp
R-Studio - http://www.r-tt.com/
BadCopy Pro (CD recovery) -
http://www.jufsoft.com/badcopy/cdrecover.asp?rid=google&kid=gccr0205
Ontrack's EasyRecovery - http://www.ontrack.com/software/

*IMPORTANT* - Final Notes - If you don't have the skill and/or equipment
to do these procedures and the data is crucial, take the machine to a
professional computer repair shop that has experience in doing data
recovery. This will not be your local version of BigStoreUSA. In-shop
data recovery is usually not exactly cheap (for ex., my charges are
generally $150-350USD), but it normally costs less than sending the
drive to a company like Drive Savers. You need to make the
determination of the value of your data and decide what to do.

DriveSavers - http://www.drivesavers.com
Seagate Data Recovery Services - https://www.seagatedatarecovery.com/

Malke

 

[Guest]

I've already gotten as far as reading and copying everything else from the
bad hard drive EXCEPT the files for a private Administrative user. I am sure
there are certificates and keys on the drive, but what are they, where are
they, can I copy them, and (first) can I use them in any way to copy the
private directories or files from the unbootable drive? From what I've read,
they are derived from the user password and probably some date and time.
Simply creating a new admin user with the same password on a different
machine will not permit me to copy it.

If I were to copy the good hard drive sector by sector and got every file, I
would still be unable to see that I did. Access Denied unless the hard drive
boots. Without having previously designated a "recovery agent" (is there a
default?) thus providing permissions for recovery, is there any way get these
files decrypted? I have not lost the keys, physically, but are they unusable?

There is not an easy answer, unless it is NO. I have yet to find someone
with enough knowledge to make that statement. A tech told me he needed
Winternals to do it, but he doesn't realize it doesn't address the issue.

 

[Malke]

I've already gotten as far as reading and copying everything else from
the
bad hard drive EXCEPT the files for a private Administrative user. I
am sure there are certificates and keys on the drive, but what are
they, where are they, can I copy them, and (first) can I use them in
any way to copy the
private directories or files from the unbootable drive? From what
I've read, they are derived from the user password and probably some
date and time. Simply creating a new admin user with the same password
on a different machine will not permit me to copy it.

If I were to copy the good hard drive sector by sector and got every
file, I
would still be unable to see that I did. Access Denied unless the
hard drive
boots. Without having previously designated a "recovery agent" (is
there a default?) thus providing permissions for recovery, is there
any way get these
files decrypted? I have not lost the keys, physically, but are they
unusable?

There is not an easy answer, unless it is NO. I have yet to find
someone
with enough knowledge to make that statement. A tech told me he
needed Winternals to do it, but he doesn't realize it doesn't address
the issue.

If you actually encrypted the files as opposed to just making them
private, then you have a whole other issue. Making files private is
*not* the same as encryption (EFS). Your subject line and first post
referenced an XP Home laptop and since XP Home does not have the
ability to use native encryption, all you need to do is take ownership
of the files:

Take Ownership of a File or Folder in Windows XP [Q308421] -
http://support.microsoft.com/?kbid=308421

How Do I Get the Security tab in Folder Properties? -
http://www.dougknox.com/xp/tips/xp_security_tab.htm

If you used some third-party program to actually and really encrypt
those files, contact that program's tech support.

Good luck,

Malke