Daily Cup of Tech

Sometimes it takes the worst of situations to bring out the best in us.  This is what happened to me the other day.  A woman comes into the office that I work in, obviously quite distraught.  We quickly discover that she is the widow of a popular local doctor whom recently passed away suddenly.  She was carrying with her a laptop and was looking for some help.

It appears that when her husband passed away, he did not leave a record of the user names and passwords for his laptop and there was a lot of information on the system that she would be needing in the near future.  She was hoping that we could help.  Of course we could.

We Hate F8! We Hate F8!

Initially, I assumed that the users would not have changed the default administrative password from blank.  So, all I needed to do was use F8 when booting, go into safe mode, then create a new account with administrative access.

Unfortunately, F8 was disabled on the system and the only way to enable it was to log into Windows.  Time to look for something else.

Linux To The Rescue…NOT

My next reaction was to try one of the Linux based password recovery tools.  There are a number of boot CDs out there that boot a small Linux kernel and then attempt to recover the password.  After trying two different boot CDs, I quickly came to the realization that Linux was going to be of no help this time around.

It just so happens that this was no ordinary laptop.  This laptop was a Dell XPS M1730.  And, it came with dual hard drives running off a RAID array using the Intel Matrix Storage Manager.  And, it had no Linux drivers.

Ask Bart

So, how was I going to proceed.  It was obvious that there was no way to get access from a download and boot Linux CD.  Then I thought of Bart.  Since BartPE creates a self-contained bootable Windows CD, this might do the trick!

I got together the following items:

1. A blank CDR
2. A copy of the latest BartPE package
3. The RAID drivers
4. A copy of Windows XP Pro with Service Pack 1 (Sorry, you’re on your own for that one)

I installed the BartPE package to C:\pebuilder3110a on my hard drive.  Then, I extracted the drivers that I got from the Dell website and placed them in the C:\pebuilder3110a\drivers\SCSIAdapter folder in a directory called iastor. The \drivers\SCSIAdapter folder is where you can put any number of non-standard drivers that will automatically load then you boot the BartPE CD.  (For more information on the on adding drivers to a BartPE CD, see their Adding drivers page.)  I then proceeded to create the BartPE image and burn it to CD.

Getting the Files

The next step was to get access to the laptop.  I put my newly minted CD into the laptop and booted the machine from it.  Everything worked like a charm and on first try, too! (That almost never happens for me!)  I was able to access the files on the RAID array without any problem.

Now, I could probably have stopped here and copied the files that were needed to a USB drive or even burned them to a CD/DVD.  But, I wanted to provide full access to the system so that they would not have to keep coming back to me for help whenever they wanted to get something off the computer.  I would have to get the passwords for her.

All Your Passwords Are Belong To Us

To start the process of password recovery, I needed to get a few things:

1. USB flash drive
2. ophcrack password recovery software
3. Vista password tables for ophcrack

I booted the laptop one again with the BartPE disk and made sure the USB flash drive was available to the system on boot up.

Next, I started to look through the system and I searched for two files:

• C:\Windows\System32\config\SAM
• C:\Windows\System32\config\SYSTEM

I copied these two files over to the flash drive, took out the flash drive and shut down the computer.

I then installed ophcrack on my other computer and installed the Vista tables.

Next, I used the Encrypted SAM option to load the files into ophcrack.  It immediately recognized all of the accounts that were on the system.  It also indicated that the Administrator account and the Guest account had blank passwords.  That means that if F8 had been available, I could have gotten into the system in Safe Mode (stupid F8).

So, I started the password recovery process and DING! 29 seconds later I had all of the passwords for the three other accounts on the system.  I tried all three and they all worked.

Looking back at the passwords now and the hints that were given in Windows for the passwords, I was on the right track to guessing them but this was a much quicker process.

Lessons Learned

Through all of this, I have learned some lessons about security, passwords, and computers:

1. Unless you encrypt your hard drive or use some other form of access other than a password (e,g, biometrics, smart card, etc.), it is relatively trivial for someone to get your passwords if they have physical access to your system
2. Someone does not have to have physical access to your system the entire time they are trying to hack your password.  Simply grabbing a couple of files from your computer takes a couple of minutes and they can hack away at your system at their convenience
3. In the event of your untimely passing, would your loved ones know how to get access to your computer, e-mail, Internet accounts, etc.?  If not, you may want to consider a way of getting that information to them

Trackback link - http://www.dailycupoftech.com/2009/02/26/vista-password-recovery-helps-widow/trackback/