Windows XP password

[Diabolus]

I need to review some files in a computer of a terminated employee. Is there an easy way to recover the password and/or bypass it so I can view the files?

Thanks

[Jeepers]

ophcrack

[briguy73]

ophcrack

+1 ^^^

[erik_26]

+1 ^^^

+2^^^

[Nose Nuggets]

i always keep a Hirens cd in my bag

http://www.hiren.info/pages/bootcd

it has a few different xp password tools on it. boot to the cd, pick passwords, pick the account, and it will just remove the password from the account all together.

alternatively, you could log in with another local admin account, take ownership of his files, and not have to crack passwords at all.

OR, if you guys have a domain and its joined to the domain, you have a whole mess of options.

how many people in your company? need IT services? (shameless plug).

[ibanezfoo]

Theres a ton and not all work on all computers...

Hiren's, ERD (locksmith), some Linux tools, Active@, Ophcrack but you need a $1000 7gig file to find out the current password (or just "find" that file somewhere else). We've had the most success with ERD... works on servers with weird RAID setups and stuff. You need to be careful though if you aren't the official "administrator" if you are under SOX rules or whatever....

[Diabolus]

Issue resolved!

thanks everyone

[ldivinag]

if you have admin rights to the machine, and you just cant open the files due to non ownership, just right click on the folder and make yourself the owner of the folder...

[ocabj]

Never start the actual system the drive is installed in that you are running forensics on. Pull the drive, image/clone it for backup, then analyze the drive on another host using a USB, FireWire or other interface adapter.

In the event you find something incriminating, you want a clone of drive for evidentiary review by other authorized parties. Also, it's possible that there are malicious programs running in the host machine designed to wipe data (e.g. Disgruntled employee). Thus, never boot the host system for forensics.

[stilly]

Never start the actual system the drive is installed ...

... Also, it's possible that there are malicious programs running in the host machine designed to wipe data (e.g. Disgruntled employee). Thus, never boot the host system for forensics.

Oh come on now. Those things ONLY happen in teen hacker movies...

[Bryansix]

Wierd. I've never heard of most of these solutions. I use OfflineNT and LiveXP with the password recovery tool. Both fit on a bootable CD or Flash Drive.