Decrypting NTFS

[Nate]

Does Safe Mode work? If not then just re-install windows like someone already suggested.

[deadly7]

The boot menu's never given me an option to log.

[iago]

Does Safe Mode work? If not then just re-install windows like someone already suggested.

No. 

I'm the one who suggested re-installing.  But won't that hose my encryption keys?  I don't care about getting Windows back, as far as I'm concerned I can smashify this harddrive once I get the files off.  But I just want the files. 

[iago]

Losers

I had another idea, I wonder if I can replace the system files on the broken computer with files from a good computer and they'll work...

I really wish I knew why the broken computer wouldn't boot, though.  An error message or log or something would be handy, but all I know is that, when Windows is installed, it posts then reboots, posts then reboots, etc.  Does anybody know a way to figure out what's wrong? 

Boot it, after POSTing repeatedly press F8 until the safe boot menu pops up.  Enable Safe Mode with Boot Logging.  See if it still reboots.  If not, then you've got a problem device driver.  If so, then send me the file bootlog.txt which is in either c:\, c:\windows, or c:\windows\system32.

Ok, I got logging enabled.  But there is no such file in any of those folders (yes, I enabled hidden files, and yes, I searched the entire harddrive). 

Any other ides?

[MyndFyre]

Losers

I had another idea, I wonder if I can replace the system files on the broken computer with files from a good computer and they'll work...

I really wish I knew why the broken computer wouldn't boot, though.  An error message or log or something would be handy, but all I know is that, when Windows is installed, it posts then reboots, posts then reboots, etc.  Does anybody know a way to figure out what's wrong? 

Boot it, after POSTing repeatedly press F8 until the safe boot menu pops up.  Enable Safe Mode with Boot Logging.  See if it still reboots.  If not, then you've got a problem device driver.  If so, then send me the file bootlog.txt which is in either c:\, c:\windows, or c:\windows\system32.

Ok, I got logging enabled.  But there is no such file in any of those folders (yes, I enabled hidden files, and yes, I searched the entire harddrive). 

Any other ides?

If you can boot it up, just recover the files?  Or no booting at all?

Edit: my bad:

Enable Boot Logging

Starts while logging all the drivers and services that were loaded (or not loaded) by the system to a file. This file is called ntbtlog.txt and it is located in the %windir% directory. Safe Mode, Safe Mode with Networking, and Safe Mode with Command Prompt add to the boot log a list of all the drivers and services that are loaded. The boot log is useful in determining the exact cause of system startup problems.

[iago]

Enable Boot Logging

Starts while logging all the drivers and services that were loaded (or not loaded) by the system to a file. This file is called ntbtlog.txt and it is located in the %windir% directory. Safe Mode, Safe Mode with Networking, and Safe Mode with Command Prompt add to the boot log a list of all the drivers and services that are loaded. The boot log is useful in determining the exact cause of system startup problems.

That doesn't exist either.  I searched the harddrive for "*nt*log*" just to be safe, including hidden/system files. 

And I can't boot it up, I'm making it a slave drive. 

Any other ideas? I'm about ready to give up and put the harddrive in storage ("limbo") until I think of something else or get access to forensic software again. :-/

[Furious]

Enable Boot Logging

Starts while logging all the drivers and services that were loaded (or not loaded) by the system to a file. This file is called ntbtlog.txt and it is located in the %windir% directory. Safe Mode, Safe Mode with Networking, and Safe Mode with Command Prompt add to the boot log a list of all the drivers and services that are loaded. The boot log is useful in determining the exact cause of system startup problems.

That doesn't exist either.  I searched the harddrive for "*nt*log*" just to be safe, including hidden/system files. 

And I can't boot it up, I'm making it a slave drive. 

Any other ideas? I'm about ready to give up and put the harddrive in storage ("limbo") until I think of something else or get access to forensic software again. :-/

Some computers come with repair disks, which just replace the essential files for the OS and don't tamper with any others.

[iago]

Nope, I manually installed Windows XP. 

[MyndFyre]

Nope, I manually installed Windows XP. 

Did you do a repair install over the drive?

Boot from the CD and select that you want to install, go through the options and it should detect your sister's XP system.  Tell it that you want to install to that path, and it will ask if you want to do a clean setup or repair.  Do repair.

[iago]

Nope, I manually installed Windows XP. 

Did you do a repair install over the drive?

Boot from the CD and select that you want to install, go through the options and it should detect your sister's XP system.  Tell it that you want to install to that path, and it will ask if you want to do a clean setup or repair.  Do repair.

You're positive that that won't blow out any accounts?  That's why I've been avoiding doing that, I'm not positive that I'll still be able to log in. 

If you're reasonably sure, I'll do it.  I don't have much to lose at this point.

[MyndFyre]

Nope, I manually installed Windows XP. 

Did you do a repair install over the drive?

Boot from the CD and select that you want to install, go through the options and it should detect your sister's XP system.  Tell it that you want to install to that path, and it will ask if you want to do a clean setup or repair.  Do repair.

You're positive that that won't blow out any accounts?  That's why I've been avoiding doing that, I'm not positive that I'll still be able to log in. 

If you're reasonably sure, I'll do it.  I don't have much to lose at this point.

Repairing an installation will definitely not destroy any accounts, *unless* the accounts are already toast, which would make the matter a moot point anyway.

[iago]

Repairing an installation will definitely not destroy any accounts, *unless* the accounts are already toast, which would make the matter a moot point anyway.

Yeah, the accounts are fine, as far as I can tell.  I was able to view information about them and bruteforce their passwords, so at least the SAM and other stuff are intact. 

I don't have access to a computer to get that going right now, unfortunately, but when I do I'll be sure to let you know how it goes. 

[Chavo]

Hmm, the boot menu doesn't give me the option to log?

I get:

Safe Mode
Safe Mode with Networking
Safe Mode with Command Prompt
Last Known Good Configuration (which doesn't work)
Start Windows Normally

Any idea how to make it show up?

ew@ Windows XP Home

I don't know if you can with the crippled version

You -could- try using Windows XPE to boot from CD into Windows and recover whatever files you need that way.  I don't know if it costs though, I've had my copy for a good 5 or 6 years.

EDIT: This looks similar to what I have.

[MyndFyre]

Hmm, the boot menu doesn't give me the option to log?

I get:

Safe Mode
Safe Mode with Networking
Safe Mode with Command Prompt
Last Known Good Configuration (which doesn't work)
Start Windows Normally

Any idea how to make it show up?

ew@ Windows XP Home

I don't know if you can with the crippled version

You -could- try using Windows XPE to boot from CD into Windows and recover whatever files you need that way.  I don't know if it costs though, I've had my copy for a good 5 or 6 years.

EDIT: This looks similar to what I have.

Oooh, I didn't know it was Windows XP Home.  You're not even supposed to have the Encrypting File System in XP Home (probably to keep home users from doing something like this).  If you need I can send you an XP Pro ISO.

[iago]

It's not Windows XP home, it's pro.  What makes you think it's home?