Finding Hard Drive Using Knoppix STD
 

I am not very experienced with linux, and i heard that knoppix STD was the best way to recover the Windows/system32/config/sam file. I have booted up the program on several computers and have been unable to find the hard drive to even begin to search for the file. Knoppix loads onto a RAMDrive, and is booted from the CD. If you guys could help me out, i am trying to recover some documents off of my computer, and i have misplaced my password.

If it may help, the hard drive is a Serial Ata.

Linux requires that you mount a filesystem to a drive before you can view its contents (furthermore, it requires that you mount it with the RIGHT filesystem) Since this drive is a Windows formatted drive, and is a SATA drive - it should be listed as a sd drive. Considering that it is your only Sata drive in the computer, it should be sda (note that if there are more than one SATA drive it will be sdb, sdc or sdd). So what you can do to mount and access this drive is to move into the /dev/ folder and see what entries are in there with the sd prefix. YOu can do this like so (anything inside the ''s is a command - input this into the terminal):

1) Open a terminal
2) 'cd /dev/' (Much the same as the DOS command)
3) 'ls sd*'
4) The results from this will give you what you need. If you have multiple partitions on the hard drive, they will come back as sda1, sda2 and so on. These are what you need to mount to find what you need. Assuming that all of these partitions have a FAT 32 filesystem on them these commands will mount them so you can find what you need:

1) Open terminal (if it isn't already open)
2)'su' (to change to root user)
3)enter the root user's password
4) mkdir /mnt/sata
5) mount -T vfat /dev/sd** /mnt/sata

Those stars are the a,b,c, or d and the 1,2,3,4 from earlier. Now you are ready to launch your file browser and look for what you need. If you mount the wrong harddrive partition, you can try again by doing this:

1) Open Terminal (if it isn't already open)
2) 'su'
3) enter root password
4) 'umount /mnt/sata'
5) 'mount -T vfat /dev/sd** /mnt/sata'

Hope this helps and isn't too wordy.

only like any XPS computers uses ntfs... does that change anything?

It does change some of the things I said above, but not TOO much. First of all you need to replace the command:

mount -T vfat /dev/sd** /mnt/sata

with
mount -T ntfs1 /dev/sd** /mnt/sata

The problem comes here: Linux write to NTFS is quite experimental at the moment, so most people do NOT write to their NTFS drives, and consequently I am really of no help with NTFS write either, as I have never needed it. However, there are experimental (I repeat EXPERIMENTAL) steps and programs to allow you to write to NTFS partitions. Should you need those, check out captive and ntfsprogs. ntfsprogs is here and captive is here. Hope everything goes Okay - and let me know should you need some more help.

actually, i am just trying to retrieve information off of the hard drive, i dont really need to write anything. If possible i would like to run chntpw, but i need access to the hard drive to attempt it

I have yet to try 'mount -t ntfs1'

i typed the following 'mount -t ntfs /dev/sda1 /mnt/sata' basically no 1
i created the sata directory and i got the following response 'not a valid block device' what does this mean?

so i went back to the dev directory and 'ls sd*'
came up with like 50 listings. some were in yellow, and some were in blue sda and sda1 were yellow.

oops - it's actually mount -t ntfs (no 1)

and hmm...it sounds like your system is using devfs instead of udev.

Repeat the ls command but change the sd part to be hde*. Does that report anything?
I'm not sure what to do - I'm sorta bottom fishing here, but from what I understand /dev/sda* may also be /dev/hde*. Not sure what to do if it isn't though...

ihave no idea what the device is labeled, what is the difference in colors yellow and blue?

It'd help if you posted the output of "fdisk -l" (run it as root).