How to write or modify NTFS files with KNOPPIX

[askme]

I wanted to delete SAM file from my password loss computer after booting with Knoppix 3.4, but it failed to modify, delete or write SAM file saying that "read only file".
How to modify or delete NTF files.

[Harry Kuhman]

You don't.

[redhawk]

I wanted to delete SAM file from my password loss computer after booting with Knoppix 3.4, but it failed to modify, delete or write SAM file saying that "read only file".
How to modify or delete NTF files.

You should not delete the SAM file Windows still requires this even if no password has been set. You have two options, if you installed XP with no password set but set it later then use a copy of SAM from c:\windows\repair. Alternatively you could try and crack the password there are a few tools floating around on the net like L0phtCrack and some linux ones.
Anyway if need to access you NTFS drive forget Linux use a boot disk - http://www.free-av.com/antivirclassi..._ntfs4dos.html (requires Win98 system / FreeDOS formated floppy)

[benny_mott]

if you have lost your password try dreampackPL
that guy Damian also got an ISO of a bootable CD that reads and writes to NTFS on his web site
http://www.d--b.webpark.pl/index2_en.htm

that siteabove is ON and OFF all the time



dreamPack:

This tool give full access to Windows 2000/XP. DreamPackPL do not change/overwrite old passwords, therefore EFS encrypted files will be still readable.


Features :

+ executing programs (from list: e.g. regedit or any other) at the logon desktop with system privileges,

+ loading Explorer shell at new desktop and work as impersonate user with system privileges ('Spirit mode'),

+ displaying local accounts list (user names) in logon desktop,

+ turn off/on logon password check (full access to every local account without modifying old passwords),

+ disabling Windows File Protection.
Current version: 2oo4.o3.27

http://www.d--b.webpark.pl/index2_en.htm


......................................
DreamPack(pinball.xe_)size only 46KB
link removed by Ben after reading theregister

will allow you to enter any Windows 2000 (server 2003) and XP computer PRO (home) with Password
and read any files even the sfc encreypted files and then walk out
without leaving a foot print on the computerby simply uninstalling it and renamiing the original

file(sfcfiles.dll)
you can use bartPE to do below in gui Explorer window drag and drop or BartPE command line

(assuming pinball.ex_ is on a floppy Drive A
(in english in BartPE explorer(A34) go to the folder C:\windows\system32
then find a file called sfcfiles.dll and rename it to sfcfiles.lld
then copy pinball.ex_ from the floppy drive to system32 folder and rename it sfcfiles.dll
your are done!!)
at login text box enter:
dreamon
and enter on key board
you get a menu called dream pack
click just below menu bar(try bouble click and right click)
you get context menu
choose password>login with wrong password
restart computer
this time enter any password and it will be accepted
................
{to go back to orignal situation delete the(pinball.ex_(now called sfcfiles.dll in

C:\windows\system32 folder) and rename the origial file sfcfiles.lld to sfcfiles.dll again and

you are back where you started}

................................
what is(dreampackPL) pinball.ex_ ???
simply put is an empty sfcfiles.DLL file with all functions removed and all headers left in so

windows security checks all header files and sees every thing is in place then continues
Correct


regards Ben

[yodabug]

I don't know about the other tools psoted because I have always use the following:

http://home.eunet.no/pnordahl/ntpasswd/

I use it because it works. Period. I have used it at least 2-300 times in the past years on my own and my clients computers.

I have also reset the administrator password on active directory using this tool and a set of steps that are link from the above website. Win2k# runs perfectly fine for years without rebooting, I forget the password often cause I rarely log into Win2k3...

Eitherway, I am sure the above tools are good, but I will stick with my tried and true tools for now and highly suggest using them to others. You MUST READ the directions though, don't just go off all half-cocked and start editting passwords. Specificaly, setting a blank password is the MOST effective way of using this tool, once you have re-gain access to the administrators desktop you can then set whatever password you want.

Cheers and good luck!

[jmaton]

I wanted to delete SAM file from my password loss computer after booting with Knoppix 3.4, but it failed to modify, delete or write SAM file saying that "read only file".
How to modify or delete NTF files.

I realize the original post was years ago, but if you google: "delete SAM" knoppix
then this post is at the top of the search results. So I hope the answer will be useful.

I just deleted the SAM file using Knoppix 5.1, here is the procedure:

Knoppix mounts the drive as read only, so you need to unmount it, then mount as read/write:

1. Open a shell ("Konsole")

2. Switch to user root by entering command "su" without quotes

3. Enter command "mount" (without quotes) and determine which device is your hard drive.
It will probably be at or near the end of the list, and mounted into the /media directory.
Take note of the device (example: /dev/sda1 ) and the mount point (example: /media/sda1 )

4. Assuming your hard drive is /dev/sda1 , you would unmount with this command:
umount /dev/sda1

5. Mount the drive with read-write access, to the same mount point you were using before:
mount /dev/sda1 /media/sda1 -o rw

Now you can remove any file you want, for example the SAM file:
rm /dev/sda1/WINDOWS/system32/config/SAM

--jmaton

[rickz]

Thank you so much for the input. I was just searching for the follwoing info.

[kirol]

It's a very bad idea to revive an old thread with no specific mention of which version to use IMO.

Anyway, I'd strongly advise against mounting an NTFS partition read/write with the default driver.
Learn to use ntfs-3g for this. Knoppix 5.1+ has a working version, albeit older (predating their 1.0 release)
Please use a more recent live-CD (e.g. sidux) when writing to NTFS filesystems.

[jmaton]

It's a very bad idea to revive an old thread with no specific mention of which version to use IMO.
...
Learn to use ntfs-3g for this. Knoppix 5.1+ has a working version

I think it's a lousy idea to revive old threads -- that have a working answer posted -- and then talk a little trash.

It was Oct 2007.
I stated I was using Knoppix 5.1.

And I agree that ntfs-3g is nice, but it leaves a sour taste when posters like you say "no, your method is bad", but only provide a link and then say "learn to use it". That isn't helpful to people like the original poster, who simply wanted to delete a SAM file and then get back to work in Windows. A Knoppix disc is a great utility for tasks like this, and the default driver works just fine for it.

But for those interested (especially if you are using Knoppix regularly to access NTFS drives), here's the modified mount command for the example I provided:
mount -t ntfs-3g /dev/sda1 /media/sda1 -o rw

Cheers,
-jmaton