UGN Security Forums UGN Security: Knowledge Base Operating Systems Windows & Windows Security EFS question.

Yo, aint posted in here for a while. Got a question thats been bugging me for a while now.

Ive got an account on this computer (Windows XP), there should be one or two files in it. Now I have forgotten the password to log on, obviously I have physical access. This is what i was planning on doing.

I was gonna boot the computer with a Knoppix STD live CD. Then i can run ntpassword, which bearing in mind i have never used before. Supposedly this inserts a new password hash into the sam, therefore allowing me access. Someone told me that this wont let me view any files that have been encrypted using EFS, which is a windows standard.

My question is this, if i use ntpassword to change the password hash and login with the new password, will i be able to view any files? Does Windows encrypt everything automatically using EFS?

Any help is muchos appreciated, and yes, ive googled

Windows doesen't encrypt anything automagically.
[WHOLE BUNCH OF STUFF EDITED OUT]

EDIT: Since I decided to google cuz I feel bad making such an information-less post, did you see this ?

FURTHER EDIT: Ok, I read that entire post I linked to. It seems like you can't recover encrypted files because you need to use the password they were originally encrypted with. Unless you used XP to encrypt these files, you're fine.

ntpasswd doen't work with Xp. It only works with NT and 95/98 as far as I know.

Infinite

If you have XP home...You should be able to boot into safe mode and login with as the administrator.. you did forget the login password right? hehe I've been up for a while so excuse me if this information has no use at all!