Re: Access NTFS drive by mounting in another machine

From: Phillip Windell (_at_.)
Date: 10/20/04 

Date: Wed, 20 Oct 2004 08:15:19 -0500

The NTFS Permissions are only recognized by the OS that put them there. The
OS of the infected drive isn't running so the Permissions wouldn't be in
effect. So the NTFS permissions shouldn't be in the way at all unless the OS
of Machine B put them there. It is no different than backing up the Drive
with Ghost then using Ghost Explorer to open the Image and extract any files
you want from it. 

-- 
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
"Philip Herlihy" <foof8501@herlihy.eu.veil.com> wrote in message
news:%23$Nn5motEHA.2116@TK2MSFTNGP14.phx.gbl...
> A scenario:  Machine A has a horrid virus and we want to salvage the data
> from the disk.
>
> We take the NTFS drive out of A and mount it (eg external USB housing or
> adapter) on another machine B, hoping to get access to the data without
> running any of the malware that would start if the disk was being used to
> boot.
>
> However, NTFS file permissions prevent access to the disk when mounted in
> machine B.  Any way round this?
>
> I'd guess that if A and B are in the same domain then a user of A could
log
> on to B and access the disk "legally" but in most cases the machines will
be
> unrelated.  Is there any way to get to the data?  Maybe one answer is to
> create another partition (if there's space) using BootitNG or Partition
> Magic, install a second copy of Windows and boot from that as
Administrator.
> Comments welcome.
>
> -- 
> ####################
> ##  PH, London
> ####################
> Apologies for the duplicate posting - I "missed" my intended newsgroup!
>
>

Relevant Pages

  • Re: Access NTFS drive by mounting in another machine
    ... but I've certainly been unable in the past to access an NTFS drive ... > The NTFS Permissions are only recognized by the OS that put them there. ... >> from the disk. ... >> create another partition using BootitNG or Partition ...
    (microsoft.public.security)
  • SUMMARY: Moving /usr From Under Root "/" To Its Own Partition
    ... One of the reasons for doing this is to end up with a smaller root ... Install the boot block and boot off the new drive. ... " In order for the root partition to be fscked and remounted ... D> temporarily on the existing disk. ...
    (SunManagers)
  • Re: laptop - new HD - no CD or floppy drive
    ... I put the laptop HD back in the PC and I could boot from it. ... If the primary partition has an incorrect boot sector. ... If the disk geometry is incorrect. ...
    (microsoft.public.windowsxp.hardware)
  • Re: laptop - new HD - no CD or floppy drive
    ... I put the laptop HD back in the PC and I could boot from it. ... If the primary partition has an incorrect boot sector. ... If the disk geometry is incorrect. ...
    (microsoft.public.windowsxp.hardware)
  • Re: Can I boot of an XP System disk, nested in a logical volume
    ... I'll boot of Partition Magic or some other kind of magic and fix it that-a-way. ... It's been a long time since I messed with partitions like this, but in the back of my head I have this fragment about boring registry hands-on editing, 'derived Disk ID's' and the 'Master Boot Sector' -- that's S as in 'Senile'. ... One reason for the drive letter change on cloned drives is to keep the parent drive hooked up the first time the clone is booted, being that the clone has the same Mount Manager database, and being that the Mount Manager *always* respects drive letter assignments, it will see the parent drive and its valid disk signature and assign the C: drive letter to the original C: drive, so there will be no C: letter available for the clone. ...
    (microsoft.public.windowsxp.basics)