"NC Beach Bum" <NCBeachBum@discussions.microsoft.com> wrote in message
>I am working with a PC that has account and password issues so the user
> blocked from accessing his files. I have tried Orphcrack on the
> system but
> it's not showing any passwords. The user tells me the system has
> acting odd for some time now and - of course - he does not have a
> backup and
> to make it worse his tax information is on the system so he had to
> file an
> extension to get time for me to do this recovery and restore. I need
> pull his files from the system to wipe, perform a clean install, setup
> account and restore his files. What is the best way to do this?
Have you tried a penetration testing live CD like BackTrack?
If files weren't encrypted, it might be possible to use some of the
"Accessibility" programs running on the logon desktop. Some refer to
"Stickykeys" as sethc.exe (but actually 'set high contrast') you can
invoke a copy of cmd.exe renamed as sethc.exe from the logon screen.
Protected files need to be replaced in the resource protection cache as
well or they will be swapped at reboot and you are back where you