XP Password Issue

[Erick]

I have a customer that brought an old laptop to me to get some files off of it.

It's running XP Pro which I didn't think would be an issue. I've used a few utilities like Hirem's and others to reset XP passwords. Always worked fine.

In all of the tools I'm getting errors that the drive either can't be mounted or isn't there.

I fired up MiniXP and in NTPWEdit it's telling me that there's a B:\ drive called RamDrive and the C:\ drive is not formatted (I know it is, it's running the OS which I can boot to the login screen on).

Prior to this I imaged the machine using Acronis True Image. Just fired it up to pull out files and folders manually and there are no files. It's just a C:\ drive.

Does anyone know of a third-party utility that created a "B:\RamDrive"? Google results show some Windows-based utilities but this doesn't seem to apply to what it is.

 

[glricht]

1. Test the HD itself, could very well be bad
2. Pull the HD and access it offline from another PC

 

[mikeroq]

The ram drive is from the MiniXP.

Pull the drive and hook it up to another computer. Can test the drive when you hook it up as well.

 

[Erick]

1. Test the HD itself, could very well be bad
2. Pull the HD and access it offline from another PC

Pull the drive and put it into a Windows 10 machine.

No errors or issues in CrystalDisk. Perfectly healthy.

On mount it asked me if I wanted to format. In Disk Management it lists it as RAW.

Verified this is the only HD in the machine by booting it up when the drive was out and it couldn't find the OS.

 

[glennd]

I'm confused. Is the disk booting or not? If it's not booting then mount it in Linux and look at the partition table in GParted. Though it may be too late, it sounds like the partition table has already been mangled. You might be doing the long haul data recovery...

 

[mikeroq]

Did you actually run a self test or just looked at the smart data?

I've had drives before that would boot up just fine but the partition would show as RAW in my machine. Sometimes I could get away with running chkdsk to repair the filesystem. Some of them that showed raw when I ran chkdsk it would pick it up as NTFS then once chkdsk was done I could access the files on my machine. YMMV. I would at least make a sector by sector image or clone of the drive just in case and work off the image.

 

[Erick]

I'm confused. Is the disk booting or not? If it's not booting then mount it in Linux and look at the partition table in GParted. Though it may be too late, it sounds like the partition table has already been mangled. You might be doing the long haul data recovery...

The disk is booting. Sorry if I wasn't clear about that.

 

[Mick]

If it boots, try it in safe mode and see if the Administrator account is passworded - might not be.