recovering data from an NTFS partition October 21, 2007
situation
You have a hard disk that used to be in a Windows 2000 or XP machine, formatted with NTFS.
You need to recover user data (eg. documents, email, images) from the drive.
You have connected the drive to a Windows 2000 computer, as a slave, set the BIOS correctly,
and booted as usual (eg. you have NOT booted from the drive you need to recover data from -
don't try that, it will likely fail)
You have logged in as Administrator
You can see the drive and the file system as E:, F: or whatever on your W2K box
BUT when you try and access the user directories (in the Documents and Settings directory)
you do not have permission, and get access denied
solution 1
Take ownership of the user directories in question:
Right-click on c:\documents and settings\username
select properties
click the security tab
untick the box, [ ] Allow inheritable permissions from parent to propagate this object
click Advanced
click the Owner tab
click either Administrator or Administrators
tick the box [ ] Replace owner on subcontainers and objects
click OK
copy the files you need to copy
solution 2
Escalate your privileges to SYSTEM:
click Start.. Run...
type CMD and press Enter
note the current system time
type AT time /interactive c:\winnt\system32\cmd.exe (where time is the current time, plus 2 mins)
wait 2 minutes - a new command prompt window will appear
type Explorer and press Enter, or run your favorite file manager - the new command prompt window, and all tasks spawned by it, are running as SYSTEM
copy the files you need to copy
Use this method when the first method fails, which may happen on some objects, including the Recycle Bin.
notes
2003 & Vista drives not tested, may work the same way
2000 used for the recovery, XP, 2003, Vista may work as well
recovered files were copied to a FAT32 partition on a separate drive, this may have
made it easier to read the recovered files (eg. if the recovered files had been copied
to an NTFS partition, they may have had their permissions copied as well, which would
have frustrated the recovery. Recovery to an NTFS partition has not been tested)