PDA

View Full Version : extraction of system/encrypted data from fail(ing/ed) hard drive


asacan
December 9th 03, 10:32 AM
Hardware configuration:
Athlon XP 1900+
MSI KT266Pro
1024MB Corsair (Value) DDR2100 RAM (2 sticks 512MB)
AGP: Radeon 9700PRO
PCI:
1: Maxtor (Promise) UltraTX133 IDE adapter
2: Creative SoundBlaster
3: Linksys 10/100 NIC (LNE100 or something)
4: Netgear FA2112 NIC (10/100 with WOL)
5: US Robotics (USR5610B) 56k v.92 Performance Pro
IDE 0 of onboard:
Primary (hdd0): WD 60GB/8MB Cache 7200RPM
Primary partition: 48GB NTFS-WindowsXP Pro(MBR)
Logical partition: 12GB NTFS
Secondary: Empty
IDE 1 of onboard:
Primary: Acer DVD/CD reader
Secondary: Empty
IDE 0 of IDE adapter:
Primary: Maxtor 160GB/2MB 5400RPM
Partitions 1-8: 80GB total Ext3, Red Hat Linux 9
Partitions 9-15: 60GB total ReiserFS, Suse 8.2
Partitions 16-20 20GB total XFS, Debian 7.1
Secondary: Empty
IDE 1 of IDE adapter:
Primary: TDK CD Read/Write/Rewrite (4800B)
Secondary: Iomega Zip100 IDE
Power Supply: Antec TruPower 430W
Other configuration: Served by Linux
router/firewall/NFS on networked cable connection.

Problem: Was using multiple computers late one night.
After working for a while on the Linux server, turned back
to WindowsXP machine to discover the machine was running
excruitiatingly slowly. Attempted to do a clean reboot,
but machine appeared frozen. Did hard re-boot into
WindowsXP, flash screen appeared, then system rebooted
self. Continued. Turned off computer, checked EIDE/power
connectors, discovered small whole in 1 of 80 wires on
EIDE connector (closer to motherboard). Replaced EIDE
connector, but still could not get past Windows "splash
screen". Booted into Suse Linux, could view/access data
from Windows HDD, but slowly (subsequent accesses became
much quicker). After moving homes (military), purchased
new hdd (Maxtor 120GB/8MB/7200) to attempt to create an
image (Norton Ghost) of WindowsXP drive. Installed new
hdd/Installed new instance of WindowsXP, installed Norton
Ghost, but old hdd was not recognized (in anticipation of
image, I destroyed Linux partitions to make room for
image). Attempts at recovery console have been
unsuccessful. I'm certain that there are bad blocks where
Windows start-up files are located, but could not rebuild
the start-up.

All registered software (which is all of my software) are
on that hdd, while new registration numbers will cost me
more money. I made hard-copies of reg. numbers, but since
the move I have been unable to locate them. The most
valuable information I need to access are in encrypted
files (military personnel information, not classified but
had personal data). Since I cannot log-in to that
instance of WindowsXP, I cannot access any of the
encrytped information.

Please help!

Jupiter Jones [MVP]
December 9th 03, 10:33 AM
Are you sure it is not an Ownership issue:
http://support.microsoft.com/?kbid=308421

If the files are encrypted.
If you can restore the original profile (not recreate) you may be able
to recover the data.
Recreating profiles and passwords is irrelevant.
Contact Microsoft if you can restore the profile.
Or:
http://www.beginningtoseethelight.org/efsrecovery/index.php

EFS is very good at what it does and there is no back door.
Read and understand these links before using EFS to keep from
permanently losing your data:
http://www.microsoft.com/windowsxp/pro/techinfo/administration/recovery/default.asp
(58 pages)
http://support.microsoft.com/?id=223316

--
Jupiter Jones [MVP]
An easier way to read newsgroup messages:
http://www.microsoft.com/windowsxp/pro/using/newsgroups/setup.asp
http://dts-l.org/index.html


"asacan" > wrote in message
...
> Hardware configuration:
> Athlon XP 1900+
> MSI KT266Pro
> 1024MB Corsair (Value) DDR2100 RAM (2 sticks 512MB)
> AGP: Radeon 9700PRO
> PCI:
> 1: Maxtor (Promise) UltraTX133 IDE adapter
> 2: Creative SoundBlaster
> 3: Linksys 10/100 NIC (LNE100 or something)
> 4: Netgear FA2112 NIC (10/100 with WOL)
> 5: US Robotics (USR5610B) 56k v.92 Performance Pro
> IDE 0 of onboard:
> Primary (hdd0): WD 60GB/8MB Cache 7200RPM
> Primary partition: 48GB NTFS-WindowsXP Pro(MBR)
> Logical partition: 12GB NTFS
> Secondary: Empty
> IDE 1 of onboard:
> Primary: Acer DVD/CD reader
> Secondary: Empty
> IDE 0 of IDE adapter:
> Primary: Maxtor 160GB/2MB 5400RPM
> Partitions 1-8: 80GB total Ext3, Red Hat Linux 9
> Partitions 9-15: 60GB total ReiserFS, Suse 8.2
> Partitions 16-20 20GB total XFS, Debian 7.1
> Secondary: Empty
> IDE 1 of IDE adapter:
> Primary: TDK CD Read/Write/Rewrite (4800B)
> Secondary: Iomega Zip100 IDE
> Power Supply: Antec TruPower 430W
> Other configuration: Served by Linux
> router/firewall/NFS on networked cable connection.
>
> Problem: Was using multiple computers late one night.
> After working for a while on the Linux server, turned back
> to WindowsXP machine to discover the machine was running
> excruitiatingly slowly. Attempted to do a clean reboot,
> but machine appeared frozen. Did hard re-boot into
> WindowsXP, flash screen appeared, then system rebooted
> self. Continued. Turned off computer, checked EIDE/power
> connectors, discovered small whole in 1 of 80 wires on
> EIDE connector (closer to motherboard). Replaced EIDE
> connector, but still could not get past Windows "splash
> screen". Booted into Suse Linux, could view/access data
> from Windows HDD, but slowly (subsequent accesses became
> much quicker). After moving homes (military), purchased
> new hdd (Maxtor 120GB/8MB/7200) to attempt to create an
> image (Norton Ghost) of WindowsXP drive. Installed new
> hdd/Installed new instance of WindowsXP, installed Norton
> Ghost, but old hdd was not recognized (in anticipation of
> image, I destroyed Linux partitions to make room for
> image). Attempts at recovery console have been
> unsuccessful. I'm certain that there are bad blocks where
> Windows start-up files are located, but could not rebuild
> the start-up.
>
> All registered software (which is all of my software) are
> on that hdd, while new registration numbers will cost me
> more money. I made hard-copies of reg. numbers, but since
> the move I have been unable to locate them. The most
> valuable information I need to access are in encrypted
> files (military personnel information, not classified but
> had personal data). Since I cannot log-in to that
> instance of WindowsXP, I cannot access any of the
> encrytped information.
>
> Please help!

Google