±Your Account
Membership:
New Today: 0
New Yesterday: 7
Overall: 24203
Visitors: 44±Latest Webinar
±Latest Articles
· Android Forensics
· Geo-tagging & Photo Tracking On iOS
· KS – an open source bash script for indexing data
· Mobile Device Geotags & Armed Forces
· Categorization of embedded system forensic collection methodologies
· Interpretation of NTFS Timestamps
· What are ‘gdocs’? Google Drive Data – part 2
· What are ‘gdocs’? Google Drive Data
· Bad Sector Recovery
· Forensic Artifact: Malware Analysis in Windows 8
· Geo-tagging & Photo Tracking On iOS
· KS – an open source bash script for indexing data
· Mobile Device Geotags & Armed Forces
· Categorization of embedded system forensic collection methodologies
· Interpretation of NTFS Timestamps
· What are ‘gdocs’? Google Drive Data – part 2
· What are ‘gdocs’? Google Drive Data
· Bad Sector Recovery
· Forensic Artifact: Malware Analysis in Windows 8
±Follow Us
±Latest Jobs
Back to top
Skip to content
Skip to menu
Back to top
Back to main
Skip to menu
Sorry, I should have said: Win XP SP2.
_________________
Forensic Computer Services
Lotus Notes eDiscovery and Forensics
Tape eDiscovery and Forensics
A "Can you fix my machine?" question.
A "Can you fix my machine?" question.
Posted: Tue Feb 24, 2009 6:47 am
This is not a forensic question, this is a "You know about computers, can you fix my machine?" problem.
A laptop belonging to the local Church and ridddled with viruses was given to me to fix. I attached the drive to my sheep-dip machine, removed the viruses and put the drive back in the laptop. Everything went OK, booted the machine, no password prompt, in fact no account prompt. I then cleaned up the registry and defragged the drive. The next time I booted I was taken through the account/password screen. I know that I was not asked for a password the first time because I don't know what it is.
Cleary I can defeat the password but I am interested in why this happened. Any ideas?
Thanks
Ron
_________________
Forensic Computer Services
Lotus Notes eDiscovery and Forensics
Tape eDiscovery and Forensics
A laptop belonging to the local Church and ridddled with viruses was given to me to fix. I attached the drive to my sheep-dip machine, removed the viruses and put the drive back in the laptop. Everything went OK, booted the machine, no password prompt, in fact no account prompt. I then cleaned up the registry and defragged the drive. The next time I booted I was taken through the account/password screen. I know that I was not asked for a password the first time because I don't know what it is.
Cleary I can defeat the password but I am interested in why this happened. Any ideas?
Thanks
Ron
_________________
Forensic Computer Services
Lotus Notes eDiscovery and Forensics
Tape eDiscovery and Forensics
-

roncufley - Senior Member
Re: A "Can you fix my machine?" question.
Posted: Tue Feb 24, 2009 6:57 am
Perhaps related to a change in the registry when you were cleaning it up? e.g. removal of saved profile info or a change to the default logon procedure?
Jamie
_________________
Jamie Morris
Forensic Focus
Web: www.forensicfocus.com
Blog: www.forensicfocus.com/blog
Twitter: twitter.com/ForensicFocus
LinkedIn: www.linkedin.com/in/jamiemorris
Jamie
_________________
Jamie Morris
Forensic Focus
Web: www.forensicfocus.com
Blog: www.forensicfocus.com/blog
Twitter: twitter.com/ForensicFocus
LinkedIn: www.linkedin.com/in/jamiemorris
-

jamie - Site Admin
Re: A "Can you fix my machine?" question.
Posted: Tue Feb 24, 2009 7:10 am
what OS is the machine running?!
-

fuzed - Senior Member
Re: A "Can you fix my machine?" question.
Posted: Tue Feb 24, 2009 7:14 am
- fuzedwhat OS is the machine running?!
Sorry, I should have said: Win XP SP2.
_________________
Forensic Computer Services
Lotus Notes eDiscovery and Forensics
Tape eDiscovery and Forensics
-

roncufley - Senior Member
Re: A "Can you fix my machine?" question.
Posted: Tue Feb 24, 2009 7:25 am
could be profile related!!?! maybe the profiles that were on there have been deleted some how...
Seen XP do some very very strange things in my time of using it (esp with profiles).... have a dig around and see if there are any corrupted profiles on the machine..
Seen XP do some very very strange things in my time of using it (esp with profiles).... have a dig around and see if there are any corrupted profiles on the machine..
-

fuzed - Senior Member
Re: A "Can you fix my machine?" question.
Posted: Tue Feb 24, 2009 11:08 am
Ron,
I feel I need to refer you to this video for further explanation of the behaviour you're seeing
Jamie
_________________
Jamie Morris
Forensic Focus
Web: www.forensicfocus.com
Blog: www.forensicfocus.com/blog
Twitter: twitter.com/ForensicFocus
LinkedIn: www.linkedin.com/in/jamiemorris
I feel I need to refer you to this video for further explanation of the behaviour you're seeing
Jamie
_________________
Jamie Morris
Forensic Focus
Web: www.forensicfocus.com
Blog: www.forensicfocus.com/blog
Twitter: twitter.com/ForensicFocus
LinkedIn: www.linkedin.com/in/jamiemorris
-

jamie - Site Admin
Re: A "Can you fix my machine?" question.
Posted: Tue Feb 24, 2009 11:28 am
Thanks, Jamie. That explains it all. The answer is always so simple once you know what it is.
_________________
Forensic Computer Services
Lotus Notes eDiscovery and Forensics
Tape eDiscovery and Forensics
_________________
Forensic Computer Services
Lotus Notes eDiscovery and Forensics
Tape eDiscovery and Forensics
-

roncufley - Senior Member
















