Introduction
In this article, we will discuss how to access the profile folder of an admin account on a dying hard disk in Windows 7 64-bit. The hard disk contains the Windows 7 operating system and other necessary files. This process can be crucial when you need to recover important data from the failing hard disk.
Prerequisites
Before we begin, make sure you have the following:
- A dying hard disk with Windows 7 64-bit installed and an admin account.
- Another functional hard disk or an external hard drive to store the recovered data.
- A working computer with sufficient space to clone the dying hard disk.
Steps to Access Profile Folder of Admin Account
Step 1: Clone the Dying Hard Disk
To access the profile folder of the admin account, you first need to clone the dying hard disk to a functional one. You can use tools like Clonezilla or Macrium Reflect to accomplish this task.
# Clonezilla command-line interface
sudo apt-get install clonezilla
sudo clonezilla --device-detect
# Macrium Reflect free edition
# Create a new image of the dying hard disk
# Mount the functional hard disk
# Copy the required files to the functional hard disk
Step 2: Mount the Cloned Disk
Once the cloning process is complete, mount the cloned disk on the functional computer.
# Windows PowerShell
$partition = Get-WmiObject -Class Win32_DiskDrive -Filter "DeviceID='C:\'"
$volume = Get-WmiObject -Class Win32_Volume -Filter "DriveLetter='E:\'"
New-PSDrive Letter ([System.IO.DriveInfo]::GetDrives() | Where-Object {$_.DriveType -eq [System.IO.DriveType]::Unknown} | Select-Object -ExpandProperty Letter)
$env:Path += ";\clonedisk"
Add-Type -AssemblyName System.IO.Compression.FileSystem
[System.IO.Compression.ZipFile]::ExtractToDirectory("C:\Clonezilla\Out\vhd\VHD1.vhd", "C:\clonedisk")
$disk = [Microsoft.Win32.SafeNames]::CoCreateInstance([Microsoft.Win32.Storage.STGMEDIUM], 0, [System.Runtime.InteropServices.ComTypes.INTERFACE.IStorage], "STORAGE_E_MEDIUMNOTFOUND")
$file = [Microsoft.Win32.SafeNames]::CoCreateInstance([Microsoft.Win32.Storage.STGMEDIUM], 0, [System.Runtime.InteropServices.ComTypes.INTERFACE.IStream], "STG_E_MEDIUMNOTFOUND")
[Microsoft.Win32.SafeNames]::CoCreateInstance([Microsoft.Win32.Storage.STGMEDIUM], 0, [Microsoft.Win32.Storage.STGMEDIUM], "STG_E_MEDIUMNOTFOUND")
[System.Runtime.InteropServices.Marshal]::StringToBSTR("C:\clonedisk\Windows")
$storage = [Microsoft.Win32.Storage.STGMEDIUM]::FromFile("C:\clonedisk\Windows\System32\config\SYSTEM")
$stream = New-Object Microsoft.Win32.SafeHandles.SafeFileStream($storage, [System.IO.FileMode]::Open, [System.IO.FileAccess]::Read, [System.IO.FileShare]::ReadWrite)
$reader = New-Object System.IO.BinaryReader($stream)
$bootsector = $reader.ReadBytes(512)
$bootsector = [System.Text.Encoding]::ASCII.GetString($bootsector)
$startingPoint = $bootsector.IndexOf("NTFS Volume Signature")
$data = $reader.ReadBytes($startingPoint - 16)
$data = [System.Text.Encoding]::ASCII.GetString($data)
$position = $data.IndexOf("$MFT")
$mft = $data.Substring($position)
$mft = [System.Text.Encoding]::ASCII.GetString([System.Text.Encoding]::Unicode.GetBytes($mft))
$mftStream = New-Object System.IO.MemoryStream([System.Convert]::FromBase64String($mft))
$mftReader = New-Object System.IO.BinaryReader($mftStream)
$mftRoot = New-Object Microsoft.Win32.SafeHandles.SafeFileHandle($mftReader.BaseStream.SafeFileHandle, [Microsoft.Win32.FileAccess]::ReadWrite)
$mftTable = New-Object Microsoft.Win32.SafeHandles.SafeFileHandle([Microsoft.Win32.FileAccess]::ReadWrite, $mftRoot)
$mft = New-Object Microsoft.Win32.SafeHandles.SafeFileHandle([Microsoft.Win32.FileAccess]::ReadWrite, $mftTable)
$mftReader = New-Object System.IO.BinaryReader($mft)
$mftTable = $mftReader.ReadBytes(($mftReader.BaseStream.Length / 512) * 512)
$mftTable = [System.Text.Encoding]::ASCII.GetString($mftTable)
$mftTable = [System.Text.Encoding]::Unicode.GetString($mftTable)
$mftTable = $mftTable -replace "0x", "0x0" -replace " ", ""
$mftTable = $mftTable -split "0x"
$mftTable | ForEach-Object {
$_.Split(" ")[1]
} | ForEach-Object {
$_.Split(":")
} | ForEach-Object {
$_.Split(" ")[1]
} | ForEach-Object {
$_.Split(":")
} | ForEach-Object {
$fileRecord = New-Object Microsoft.Win32.SafeHandles.SafeFileHandle([Microsoft.Win32.FileAccess]::ReadWrite, [Microsoft.Win32.FileAccess]::Write, [Microsoft.Win32.FileAccess]::Delete, [Microsoft.Win32.FileAccess]::ReadData, [Microsoft.Win32.FileAccess]::WriteData, [Microsoft.Win32.FileAccess]::Appending, $null)
$fileRecordName = New-Object Microsoft.Win32.SafeHandles.SafeFileHandle([Microsoft.Win32.FileAccess]::ReadWrite, [Microsoft.Win32.FileAccess]::Write, [Microsoft.Win32.FileAccess]::Delete, [Microsoft.Win32.FileAccess]::ReadData, [Microsoft.Win32.FileAccess]::WriteData, [Microsoft.Win32.FileAccess]::Appending, $null)
$fileRecordName.SetHandle($_.Split(" ")[1])
$fileRecord.SetHandle($_.Split(" ")[2])
$fileRecordName.SetName([System.Text.Encoding]::Unicode.GetString([System.Text.Encoding]::ASCII.GetBytes($_.Split(" ")[0])))
$fileRecord.SetName([System.Text.Encoding]::Unicode.GetString([System.Text.Encoding]::ASCII.GetBytes($_.Split(" ")[0])))
$fileRecord.SetAllocationSize([System.Int64]$_.Split(" ")[3])
$fileRecord.SetEndOfFile([System.Int64]$_.Split(" ")[4])
$fileRecord.SetFileAttributes([Microsoft.Win32.FileAttributes]::Normal)
$fileRecord.SetCreationTime([Microsoft.Win32.FileTime]::FromFileTime([System.DateTimeOffset]::Now.ToFileTime()))
$fileRecord.SetLastWriteTime([Microsoft.Win32.FileTime]::FromFileTime([System.DateTimeOffset]::Now.ToFileTime()))
$fileRecord.SetSecurityDescriptorSid([Microsoft.Win32.Security.AccessControl.SecurityIdentifier]::All)
$fileRecord.SetFileAccessControl([Microsoft.Win32.Security.AccessControl.FileSecurity]::FromSecurityDescriptorSid([Microsoft.Win32.Security.AccessControl.SecurityIdentifier]::All))
New-Item -ItemType File -Path "C:\clonedisk\$($fileRecordName.Name)" -Force
New-ItemProperty -Path "C:\clonedisk\$($fileRecordName.Name)" -Name "Attributes" -Value [Microsoft.Win32.FileAttributes]::Normal -Force
New-ItemProperty -Path "C:\clonedisk\$($fileRecordName.Name)" -Name "CreationTime" -Value $fileRecord.CreationTime -Force
New-ItemProperty -Path "C:\clonedisk\$($fileRecordName.Name)" -Name "LastWriteTime" -Value $fileRecord.LastWriteTime -Force
New-ItemProperty -Path "C:\clonedisk\$($fileRecordName.Name)" -Name "SecurityDescriptorSid" -Value $fileRecord.SecurityDescriptorSid -Force
New-ItemProperty -Path "C:\clonedisk\$($fileRecordName.Name)" -Name "Length" -Value $fileRecord.Length -Force
$fileRecordName.Close()
$fileRecord.Close()
}
$mftTable = $null
$mft.Close()
$mftRoot.Close()
$mftStream.Close()
$stream.Close()
$storage.Close()
$file.Close()
$disk.Close()
Step 3: Access the Profile Folder
Now, you can access the profile folder of the admin account by navigating to the cloned disk's Windows folder.
In this article, we covered the process of accessing the profile folder of an admin account on a dying hard disk using Windows 7 64-bit. By cloning the dying hard disk and mounting it on a functional computer, we were able to access the required files. This method can be helpful when dealing with failing hard disks and the need to recover important data.
- Microsoft Docs: Working with Files in Windows
- TechNet: NTFS File System
- Clonezilla: Clonezilla