User Data Backup and Restore - Help!

I am working with a PC that has account and password issues so the user is
blocked from accessing his files. I have tried Orphcrack on the system but
it's not showing any passwords. The user tells me the system has been
acting odd for some time now and - of course - he does not have a backup and
to make it worse his tax information is on the system so he had to file an
extension to get time for me to do this recovery and restore. I need to
pull his files from the system to wipe, perform a clean install, setup his
account and restore his files. What is the best way to do this?

Thanks

--
NC Beach Bum

> he does not have a backup and to make it worse his tax information is on
> the system ...
> What is the best way to do this?

Follow Rule #1: charge by the hour.

"NC Beach Bum" <NCBeachBum@discussions.microsoft.com> wrote in message
news546EE56-FA0A-4B83-A08A-8E0B53D43D28@microsoft.com...
>I am working with a PC that has account and password issues so the user
>is
> blocked from accessing his files. I have tried Orphcrack on the
> system but
> it's not showing any passwords. The user tells me the system has
> been
> acting odd for some time now and - of course - he does not have a
> backup and
> to make it worse his tax information is on the system so he had to
> file an
> extension to get time for me to do this recovery and restore. I need
> to
> pull his files from the system to wipe, perform a clean install, setup
> his
> account and restore his files. What is the best way to do this?

Have you tried a penetration testing live CD like BackTrack?

If files weren't encrypted, it might be possible to use some of the
"Accessibility" programs running on the logon desktop. Some refer to
"Stickykeys" as sethc.exe (but actually 'set high contrast') you can
invoke a copy of cmd.exe renamed as sethc.exe from the logon screen.
Protected files need to be replaced in the resource protection cache as
well or they will be swapped at reboot and you are back where you
started.

NC Beach Bum wrote:
> I am working with a PC that has account and password issues so the user is
> blocked from accessing his files. I have tried Orphcrack on the system but
> it's not showing any passwords. The user tells me the system has been
> acting odd for some time now and - of course - he does not have a backup and
> to make it worse his tax information is on the system so he had to file an
> extension to get time for me to do this recovery and restore. I need to
> pull his files from the system to wipe, perform a clean install, setup his
> account and restore his files. What is the best way to do this?
>
> Thanks
>
Can you mount the drive in another PC and see the directories? If so
you should be able to take control of the directories and then back them
up like any other files. I had to do this when a friend's laptop died.
I mounted the disk in a XP computer and took ownership of the files
and copied everything to a new drive.

"NC Beach Bum" wrote:

> I am working with a PC that has account and password issues so the user is
> blocked from accessing his files. I have tried Orphcrack on the system but
> it's not showing any passwords. The user tells me the system has been
> acting odd for some time now and - of course - he does not have a backup and
> to make it worse his tax information is on the system so he had to file an
> extension to get time for me to do this recovery and restore. I need to
> pull his files from the system to wipe, perform a clean install, setup his
> account and restore his files. What is the best way to do this?
>
> Thanks
>
> --
> NC Beach Bum