Rescuing Users files on a corrupt HD and the security implications

Page 1 of 2 12 LastLast

  1. Posts : 120
    Win 10 Pro 64 bit
       #1

    Rescuing Users files on a corrupt HD and the security implications


    My friend's computer HD developed corrupt blocks and we could not do a restore or repair. I booted off a linux live USB stick and to my surprise was able to get access to all of my friends files and their contents but also to my relief as this meant her work was not lost.
    I say surprise because I was of the understanding that these files were only accessible to the account owner but here I was with a linux usb and having full access to those files and viewing their contents. This means that I can so the same with anyones computer? How can this be? Am I not understanding how accounts and security works on Win10 systems. I thought that files and folders belonging to an account could not be viewed by anyone who didn't have the correct password. TBH what happens when someone experiences what my friend did hadn't crossed my mind with regards to how they get back their work.

    After replacing the HD with an SSD and installing Win10 I connected up the HD and copied across the users complete account folder to the SSD, viewed it's files and contents and then switched off. Today when I navigate to the user's folder on the SSD everything is gone, vanished?!

    Can someone please explain what is going on?
      My Computer


  2. Posts : 13,898
    Win10 Version 22H2 Pro and Home, Win11 Pro and Home
       #2

    Booting a Linux LiveDVD bypasses the Windows security features, I use it several times a month. I move the files to a different drive using an adapter plugged into the USB port. Most times it's a Thermaltake BlacX box that accommodates both the 2.5" and 3.5" SATA drives. For PATA drives I use a product with cables, adapters and a power supply instead of putting into a box.
      My Computers


  3. Posts : 120
    Win 10 Pro 64 bit
    Thread Starter
       #3

    But in the second instance I wasn't using a Linux usb it was a new Win10 installation and I could explore the directory structure and file contents of that users account on the defunct HD, where was Windows security in this case?

    Are you telling me I can do the same on any Windows installation using a Linux live usb?

    I'm shocked
      My Computer


  4. Posts : 13,898
    Win10 Version 22H2 Pro and Home, Win11 Pro and Home
       #4

    Gusgf said:
    But in the second instance I wasn't using a Linux usb it was a new Win10 installation and I could explore the directory structure and file contents of that users account on the defunct HD, where was Windows security in this case?

    Are you telling me I can do the same on any Windows installation using a Linux live usb?

    I'm shocked
    1. The new install did not have the security settings from the old drive. 2. Probably, I have done it with a Linux LiveDVD, haven't tried with the USB version.

    It's usually the individual files that are protected that given me a problem such as a database file that has a password needed so it could be opened.
      My Computers


  5. Posts : 120
    Win 10 Pro 64 bit
    Thread Starter
       #5

    So let me get this straight.

    I can access another users files and have full access on a Win10 OS if I use Linux live to boot up?
    On the new Win10 install can I connect the old drive via usb and copy over the users folder and have full access or not, that's the issue for me nothing else?

    You mentioned ...
    1. The new install did not have the security settings from the old drive.

    Yes I know but I was still able to access stuff as if it did. Sorry I'm confused what question are you answering here.

    You also said...
    Most times it's a Thermaltake BlacX box that accommodates both the 2.5" and 3.5" SATA drives. For PATA drives I use a product with cables, adapters and a power supply instead of putting into a box.

    Again I'm not sure why you mentioned this, is this relevant to the post or am I missing something?
      My Computer


  6. Posts : 13,898
    Win10 Version 22H2 Pro and Home, Win11 Pro and Home
       #6

    Gusgf said:
    You also said...
    Most times it's a Thermaltake BlacX box that accommodates both the 2.5" and 3.5" SATA drives. For PATA drives I use a product with cables, adapters and a power supply instead of putting into a box.

    Again I'm not sure why you mentioned this, is this relevant to the post or am I missing something?
    Just giving an alternate way I use to recover files as sometimes an HDD failure can be attributed to other hardware issues.
      My Computers


  7. Posts : 120
    Win 10 Pro 64 bit
    Thread Starter
       #7

    Berton said:
    Just giving an alternate way I use to recover files as sometimes an HDD failure can be attributed to other hardware issues.
    Okay, thanks.
      My Computer


  8. Posts : 3,502
    Win_8.1-Pro, Win_10.1607-Pro, Mint_17.3
       #8

    Gusgf said:
    .....
    After replacing the HD with an SSD and installing Win10 I connected up the HD and copied across the users complete account folder to the SSD, viewed it's files and contents and then switched off.

    Today when I navigate to the user's folder on the SSD everything is gone, vanished?!
    Is there still an issue where everything is gone, vanished?!

    Berton explained some of the nitty-gritty re: accessing a disk with different OSes (or even a different instance of the same OS). A disk can be accessed by any machine it is attached if the file system on the disk is supported. Basic file system security is managed by the OS.
      My Computer


  9. Posts : 120
    Win 10 Pro 64 bit
    Thread Starter
       #9

    Slartybart said:
    Is there still an issue where everything is gone, vanished?!

    Berton explained some of the nitty-gritty re: accessing a disk with different OSes (or even a different instance of the same OS). A disk can be accessed by any machine it is attached if the file system on the disk is supported. Basic file system security is managed by the OS.
    Maybe Berton's posts had an answer but I'm afraid I didn't see it so ending up getting nowhere. I did post on another forum and got more or less the same info you've just posted. But they clarified it further by saying that I need to copy across files and not folders as simply copying across folders would not work. No reason was given as to why. This is going to be very tedious as there are many layers of directories within the user's account.
      My Computer


  10. Posts : 3,502
    Win_8.1-Pro, Win_10.1607-Pro, Mint_17.3
       #10

    So yes is the answer to Is there still an issue where everything is gone, vanished?!

    If you're up to it, try this:

    Create a folder on C:\ named !_Gusgf
    Answer YES to the UAC if prompted
    ** any folder name would do, but I tried to come up with a name and location that should not interfere
    Navigate to the folder C:\!_Gusgf

    Launch another File Explorer (Ctrl+N should do it)
    Navigate to the HDD with the user data you want to recover

    Select one of the user folders (Downloads, Documents, Music, Pictures, Videos) - just one .. the one with the least data
    Ctrl+C

    Return to the File Explorer with C:\!_Gusgf open
    Ctrl+V

    log out
    shut down the machine and start it back up (don't do a restart - do a cold start)

    Check C:\!_Gusgf for the folder you copied

    I can't think of any reason that the folders/files you previously copied would just disappear.
    The test above mimics what you did, but only copying one folder - if that's gone, then something is obviously wrong.

    If that folder still exists after the cold start
    I'll use Pictures as an example

    Try searching the SSD (C:\ ?? )
    Navigate to C:\

    copy the following query and paste it into the search box

    Pictures kind:=folder

    sort the results by Folder to make it easier (I add Folder path and sort by that)
    Is there a Pictures folder from the original copy (as well as the one you copied for this test and the ones that were created during the install and user account setup) somewhere on the drive?

    Why do this? Because it's common to copy something somewhere and think it was copied somewhere else. I've done it lots of times, especially with drag-and-drop copies using a touchpad. The drag ends before getting to the desired location and the drop puts it wherever the drag stopped. You can look at the folders/files - but when you come back later the stuff isn't where you think you put it.

    Just guessing what might have occurred based on my own experiences with mysteries like this
    Last edited by Slartybart; 15 Aug 2016 at 23:02.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 04:40.
Find Us




Windows 10 Forums