Click to See Complete Forum and Search --> : NTFS issue


tha 4NiK8R
December 1st, 2002, 04:19 PM
Issue:
I have a customer that has a new machine (old machine's system drive cratered) with a new install of XP. The previous machine had an 80gig drive that was used to store video files. Apparently NTFS permissions were set on the drive to allow only that user to access the drive.

I want to take ownership of the drive so we can get back to those file. The catch is I cannot access the drive and cannot see the security option.

How do I change the permissions on the drive?

NooNoo
December 1st, 2002, 05:08 PM
Some good info here (http://www.le.ac.uk/cc/dsss/docs/acls3.shtml) and here is the mskb - win2k is the same as xp when you turn off simple file sharing in xp (http://support.microsoft.com/default.aspx?scid=kb;en-us;Q266118)

tha 4NiK8R
December 1st, 2002, 07:10 PM
I changed the security settings with the Security Configuration and Analysis, from there I can see the contents of the drive (folders, files, etc). I stil can't get to it through My Computer (Access is denied)

Here is what I have done so far:

1: Reset NTFS permissions via Security Configuration and Analysis to allow everyone full control (also added the Administrator account individually with Full Control.
2: Ran CHKDSK /F
3: Added another PCI IDE controller (Promise ATA133) and put the drive on it.

I can see the drive in My Computer and in Disk Management. When I right-click on the drive I see no "sharing and security" and when I hit properties it has no security tab.

tha 4NiK8R
December 3rd, 2002, 09:32 AM
I talked to a couple forensic testing buddies of mine and the put me onto a tool called GetDataBack (http://www.runtime.org/gdb.htm) . It is light and fast. With it I was able to determine that the vfat was corrupted causing me to not be able to access the drive normally. The tool allowed me to restore all the data from the "unreadable" drive to another drive with no problems. :D

attente
December 3rd, 2002, 12:37 PM
A most radical way would be to low-format the drive :)