On 18 December 2005 10:53, Adam Bower wrote:

On Sun, Dec 18, 2005 at 10:22:09AM -0000, Ian Douglas wrote:

...

Does anyone know of a bootable Linux CD which allows both read and write NTFS file system access.

Insert does (well, i've never tried using the read/write ntfs driver but it says it does) see http://www.inside-security.de/insert_en.html for more.

Thanks for that Adam; iso download is now in progress...

Ian.

On Sun, 2005-12-18 at 10:53 +0000, Adam Bower wrote:

Insert does (well, i've never tried using the read/write ntfs driver but it says it does) see http://www.inside-security.de/insert_en.html for more.

If not then I am pretty sure the NT Password Recovery ISO does it if you escape the actual NT password changing bit (or modify the scripts).

http://home.eunet.no/~pnordahl/ntpasswd/

Some versions of that are small enough to fit on a floppy.

Do remember though that as far as I know NTFS writing is still experimental, as should any reverse engineered writing operations be to an undocumented file system. If the data on those drives is at all valuable then I would consider other methods ( NTFSDOS Professional perhaps, but that has it's own limitations )

On Sun, Dec 18, 2005 at 11:57:13AM +0000, Wayne Stallwood wrote:

Do remember though that as far as I know NTFS writing is still experimental, as should any reverse engineered writing operations be to an undocumented file system. If the data on those drives is at all valuable then I would consider other methods ( NTFSDOS Professional perhaps, but that has it's own limitations )

I think the method used by the Offline password and registry editor doesn't actually allow access to the filesystem. From what I read they use read only support to locate the sam database and then work out where the offset in that file is for the password and just overwrite those few bytes you can't add, remove or change the size of files already on the filesystem, but you can change a few bytes if you know where they are.

This is in contrast to the system Insert recovery CD uses which is the so called "captive ntfs" driver which allows full read/write etc. to the filesystem because it (AIUI) uses the actual files ntkrnl.exe and ntfs.sys from a copy of Windows XP and then accesses them through the same way that they are used in Windows (through magick and hackery) read more at http://www.jankratochvil.net/project/captive/

Thanks Adam

Hi Ten,

I don't access ntfs file systems very much so I may be wrong here, but I believe knoppix will do what you want if you feed it "knoppix 2" when prompted at boot.

Thanks for that useful tip.

The distro Adam recommended appears to be Knoppix based but I still cannot get write access to my NT 4.0 disk:

:/ # whoami root :/ # mount /dev/hda1 :/ # mount /dev/root on / type ext2 (rw) /ramdisk on /ramdisk type tmpfs (rw,size=80000k) /UNIONFS on /UNIONFS type unionfs (rw,noatime,dirs=/ramdisk=rw:/INSERT=ro) /dev/hdb on /cdrom type iso9660 (ro) /dev/cloop on /INSERT type iso9660 (ro) /UNIONFS/dev/pts on /UNIONFS/dev/pts type devpts (rw) /proc/bus/usb on /proc/bus/usb type usbfs (rw,devmode=0666) /UNIONFS/dev/hda1 on /mnt/hda1 type ntfs (ro,nosuid,nodev,umask=000,uid=919,gid=919) :/ # umount /dev/hda1 :/ # cd /etc :/ # cat fstab proc /proc proc defaults 0 0 /sys /sys sysfs noauto 0 0 /dev/pts /dev/pts devpts mode=0622 0 0 /dev/fd0 /mnt/floppy auto user,noauto,exec,umask=000 0 0 /dev/cdrom /mnt/cdrom auto user,noauto,exec,ro 0 0 # Added by INSERT /dev/hda1 /mnt/hda1 ntfs noauto,users,exec,ro,umask=000,uid=insert,gid=insert 0 0 :/ # vi fstab <I change 'ro' to 'rw' for the /dev/hda1 entry> :/ # mount /dev/hda1 :/ # mount :/ # /dev/root on / type ext2 (rw) /ramdisk on /ramdisk type tmpfs (rw,size=80000k) /UNIONFS on /UNIONFS type unionfs (rw,noatime,dirs=/ramdisk=rw:/INSERT=ro) /dev/hdb on /cdrom type iso9660 (ro) /dev/cloop on /INSERT type iso9660 (ro) /UNIONFS/dev/pts on /UNIONFS/dev/pts type devpts (rw) /proc/bus/usb on /proc/bus/usb type usbfs (rw,devmode=0666) /UNIONFS/dev/hda1 on /mnt/hda1 type ntfs (rw,nosuid,nodev,umask=000,uid=919,gid=919) :/ # cd /mnt :/ # ls -l total 5 drwxr-xr-x 2 root root 1024 Dec 19 09:29 cdrom drwxrwxrwx 1 insert insert 4096 Dec 17 11:17 hda1 :/ # cd /mnt/hda1 :/ # ls -l total 142672 -rwxrwxrwx 1 insert insert 0 Aug 3 08:13 AUTOEXEC.BAT -rwxrwxrwx 1 insert insert 0 Aug 3 08:13 CONFIG.SYS drwxrwxrwx 1 insert insert 0 Sep 27 03:06 Config.Msi drwxrwxrwx 1 insert insert 0 Aug 3 07:58 DEMONIE4 drwxrwxrwx 1 insert insert 4096 Dec 16 04:01 IAN drwxrwxrwx 1 insert insert 0 Nov 11 11:12 INTERNET -rwxrwxrwx 1 insert insert 0 Aug 3 08:13 IO.SYS -rwxrwxrwx 1 insert insert 0 Aug 3 08:13 MSDOS.SYS drwxrwxrwx 1 insert insert 0 Aug 3 08:02 Multimedia Files -rwxrwxrwx 1 insert insert 26816 Aug 3 07:19 NTDETECT.COM drwxrwxrwx 1 insert insert 0 Sep 24 15:36 NTP drwxrwxrwx 1 insert insert 8192 Oct 25 11:57 Program Files drwxrwxrwx 1 insert insert 4096 Oct 25 11:52 RECYCLER drwxrwxrwx 1 insert insert 73728 Dec 19 04:26 TEMP drwxrwxrwx 1 insert insert 45056 Oct 27 03:25 WINNT -rwxrwxrwx 1 insert insert 289 Aug 3 08:05 boot.ini drwxrwxrwx 1 insert insert 4096 Sep 28 06:37 lotus -rwxrwxrwx 1 insert insert 156496 Aug 3 07:19 ntldr -rwxrwxrwx 1 insert insert 145752064 Dec 19 03:54 pagefile.sys drwxrwxrwx 1 insert insert 20480 Dec 5 15:50 quickenw :/ # cd IAN :/ # ls -l total 4220 -rwxrwxrwx 2 insert insert 14014 Nov 18 15:36 4_way_0_5m_Mains.jpg -rwxrwxrwx 2 insert insert 13500 Dec 14 03:11 4_way_0_5m_Mains2.jpg drwxrwxrwx 1 insert insert 0 Dec 14 03:27 website :/ # touch test.txt touch: cannot touch 'test.txt' : Permission denied :/ #

Does the above transcript of my session give you any ideas about what I am doing wrong?

Ian.