up and down, round and round.

Sometimes people tend to forget their password for the user account on their pc, and they just _NEED_ to get access to their files. Well, what now you may think, how do I solve this? The solution is not so hard, but it requires you to clash your fingers on the keyboard and try to type some letters. This is a quick and painless fix for Windows users.

1. First up, you’ll need to fetch a copy of the ultimate I-got-all-the-tools-u-need linuxdistro called BackTrack. You can visit their download section by pressing this link and view a bunch of different versions and select the one that fits your taste or use this link to do a direct download of BackTrack4 Final.

2. Ok, here we are. We have downloaded a fresh cool copy of BT4, and are ready to reset some passwords! Hey wait a bit! Didnt we forget something? Oh yea.. First off you’ll need to burn the ISO to a DVD, since we have to boot from that DVD later on. For your ISO burning, you could use an application called ImgBurn <- clicky clicky.

3. Burn it, and stuff that DVD into the computer you wish to reset a password on.

4. Next up is that you need to ensure that the computer we want to boot, has booting from cd/dvdrom-drive enabled. Since there are five million different ways to check this on all brands, I’ll just leave you up to check it yourself. See if there is a message when you turn on your computer that says “One time boot order”, “Boot order” or something in that direction. (Dell users can probably just hit F12, and Lenovo users can hit Enter or ESC to interrupt normal boot order).

5. Things going great so far, but we haven’t touched the fun part yet. Once you booted from the DVD, you’ll get a menu where you have a bunch of different options for which settings you would like to run BT4 with. For simplicity just choose the BackTrack 4 with Frambuffer (1024×768) or choose some other option if you want that, you decide.

6. Let the magical linuxdistro boot up and wait for a line that has some green text saying root@bt4~:
We are now ready for the interesting part (and the part that we actually do something).

7. First off, we’ll need to mount our Windows drive so we can access it and locate our favourite file called SAM. Now, we need to find out which disk drive to use. Your disks would be called either hd or sd, depending on the type (IDE or SATA) and which driver that are in use. Dont pay too much attention to this right now, we want to find our correct disk and partition.

On the commandline type “ls -la /dev/sd*” if that dont return any results looking like /dev/sda1, /dev/sda2 or similar, try to run this command instead “ls -la /dev/hd*” and follow the same procedure looking for /dev/hda1, /dev/hda2 or something similar. Both those two can have an other letter like /dev/sdb1, /dev/sdc2 and so on.

We have hopefully located our correct disk, if not repeat the procedure mentioned like 2 seconds ago. In this example I will use my computer as reference, and my disk is located at /dev/sda and my partition with M$ Windows is on the first partition /dev/sda1 .

8. Now I’m going to make a folder called /mnt/mydisk where I will mount my partition using this command : mkdir /mnt/mydisk
(the /mnt folder already exists in every linux distro, so you’ll just have to make the mydisk folder, if /mnt for some reasons dont exist, use this command first “mkdir /mnt”)

Then we’ll mount our partition to that newly created folder using this command: mount /dev/sda1 /mnt/mydisk

Now we got our partition mounted, and it’s ready for access. If for some reason it doesnt list Windows when you do a “ls -la /mnt/mydisk” then you probably have the wrong disk and/or partition. Follow the step where we mounted the partition, and try with another like /dev/sda2, or /dev/hdb3 (re-read section 7 again).

9. Okay, here we are, ready to finally reset our password. Run this command: chntpw -i /mnt/mydisk/Windows/system32/config/SAM (if it says that it cannot open the file, please check the foldernames as they are casesensitive.)

10. We now got a sweet little menu with a few options, you should select option number 1 “Edit user data and passwords”. Moving on.

11. Next up you will be prompted for which user you would like to change password on, you’ll get a list of all the users. Type in the username and hit Enter.

12. Now you got the “User edit menu” with 5 possible options. On option number 4, you can unlock the useraccount if it has been locked due to a number of failed login attempts. If it’s not locked it would say something similar to “seems unlocked already”. Then skip this step.

13. We have unlocked our account if it was needed, and are ready to reset the password. Retype your desired username and hit Enter, and then type 1 and hit Enter. Your password will now be reset to blank (no password needed at login).

14. Now we want to quit and save. Type ! and hit Enter. You will now be sent back to the main menu, type q and hit Enter again. When asked to save you choose yes (type y) and hit Enter.

15. Password are reset, and we’re ready to boot back into Windows and retrieve our long lost files! Type reboot and hit Enter. You will be prompted to remove the DVD.

That’s it! Once you boot into Windows, just type administrator as username (in my example) and nothing in the password field, and click OK. You will now be logged in :-)

That kicks ass! And yeah, you can use this method on any pc which you have physical access to and able to boot from a DVD :-)