View Full Version : Undelete around Admin

12-06-2005, 01:40 AM
Please don't lock this post, WA.

My (dead) forums: http://arctic.ithium.net/IPB2.0/

I use computers in the office of the apartments where I live. I was working on my forums and somehow a file wasn't FTP'd correctly to my site. I have already deleted it from the desktop and emptied the recycle bin.

Of course I now need this file back.

The problem is that the computer has "user" (what I use) and the "Administrator" (which no one knows the password to anymore). I can't run undelete from "user" and can't install an undelete program either.

Does anyone know how I can get my php file back? I don't want to learn how to be a cracker/hacker, I just need my one file back. I have permission to access the computer files (if I can) and have physical access to the computer itself (tower with floppy and CDROM).

If this is too touchy a subject, I can be reached by email at my yahoo account; webqsd2006

If I can upload the php file back onto my forums, it will save years of hard work and past file editing. If I have to resort to uploading a new forum, I'll get my posts back from the database, but will have to start from scratch on the look, feel and mods I've done to the existing forum over the years - this was a lot of work. :(

Please help.

12-06-2005, 02:30 AM
Use a tool like phpMyAdmin (often installed on many webhosts) and bring up your database and reset the admin password directly in the database. Thats what I always did on my forums if I forgot the admin password.

12-06-2005, 02:30 AM
Unfortunately, if you have deleted the file and have attempted a recovery by using undelete and were not able to do so then you will most likely not be able to recover using the admin account...

If you have access to it, you can possibly try using SpinRite (www.grc.com)... But I would ensure that I have the administrators permission before doing so...


12-07-2005, 01:13 AM
Spookster: Thanks, but the problem is not having the admin password for the computer I'm on.

I deleted a file from the desktop and recycle bin on this computer and can't run an undelete program because I'm in "user" not "Administrator". No one in the office has the password anymore, so I can't get direct access to C:\ and cannot install any recovery software.

I have tried booting from a floppy, but after I can't get the computer to 'see' a C:\ drive, all it knows is the A:\ drive. I tried a PATH command inside the autoexec, but I don't quite know what I'm doing - it's been a long time since DOS.

sage: I doubt I'll be able to use that program. Because of not being on "Administrator" I can't install anything. I'm sure if I can get Undelete.exe to run in "user" it would work... :confused:

12-07-2005, 02:01 AM
What operating system?

12-07-2005, 02:10 AM
Since you have access to the physical computer in question, you might be able to use a utility called SAMInside, which is relatively quick in attacking the password files and extracting the passwords.

Otherwise, the administrator password... on Dell computers, it is often by default left blank. Though, sometimes (also on Dells) they've been known to get corrupted, and irretrievable (virtually unguessable too). If you know for a fact that the Administrator password has been set, then SAMInside is one of your only bets for logging into it. Some comps also come with an "Owner" account, which is administrator-level and unpassworded. CTRL-ALT-DEL at the login screen to get a text input for username and password to login with these accounts.

12-07-2005, 05:22 PM
To disuade a myth, SpinRite is a dos level program. You don't have to install it on this computer in order to use it... You just need to install it somewhere so that you can create a boot disk with it...


12-08-2005, 01:28 AM
Windows XP Professional (5.1.2600 SP1)

I tried SAMinside: "Access to C:\WINDOWS\system32\config\SAM was denied"

I tried all the basic ones; no password, "password", "Admin", "Administrator", "Let Me In", etc...

And unfortunately, Spinrite is not cheap. Cheaper than the $175 tech quote, but more than an updated forum. :(

I'm sure if I could get DOS to recognize the C:\ drive (when I boot from A:\), I could get where I need to be and remove the file that is keeping me from running Undelete.

12-08-2005, 03:19 AM
DOS doesn't natively have support for reading NTFS volumes. You need to get a boot disk which had an ntfs driver.

12-08-2005, 09:12 AM
SAMinside: "Access to C:\WINDOWS\system32\config\

Yea, you can't run SAMInside when Windows is running.

Was a while since I used the program but I think you should boot into a linux distro (Knoppix would be the best for this purpose), copy the SAM and SYSTEM files (I think?) to a removeable disk. Then run SAMInside using those files.

12-10-2005, 08:50 PM
Thanks for all your help, guys. But this is the end of the story. :(

The apartment manager decided to take the computers to a tech and just have everything wiped and have a new OS installed. So, the file is officially gone. Well, beyond gone. Waaaaay gone.... :D

Good news is that the people at Invision Power have told me if I upgrade the the new version of forums, all the basic information from the database (like posts) will be saved. Only the modifications (like colours, mods, skins) will be lost. I'm planning to upgrade as soon as I get the money; sometime in January.

jkd: I tried to use "ntfsdos" (which I thought would find C:\), but it said there were no ntfs drives found, so I assumed they were formatted FAT32. :confused:

mark87: Since I couldn't get passed the A:\ in dos, even if I ran SAMinside from the floppy, I wouldn't be able to get to the files needed.

Thanks again, anyway. :) I suppose someone can lock/delete this topic as seen fit. ;)