Bit of a difficult one, extracting XP CD Key

Discussion in 'Windows Desktop Systems' started by Skunk141, Jul 16, 2007.

  1. Skunk141

    Skunk141 OSNN Addict

    Messages:
    98
    I've got a laptop with the XP label underneath unreadable, I need to do a reload but obviously I need the CD Key, I have removed the hard disk and plugged it in to my PC so I can see the files, how can extract the XP CD Key?

    I have found the jellybean keyfinder but as far as I can work out it only works on a current active program.

    Hopefully some one can tell me a method of extraction of the key?

    Cheers

    :)
     
  2. Dark Atheist

    Dark Atheist Moderator Political User Folding Team

    Messages:
    6,376
    Location:
    In The Void
    dont know if this will work but you could give Yamicsoft WinXP Manager v5.1.5 a try, but you would have to place the drive back into the laptop same as jellybean not too sure, but if you can get the laptop to boot fully or into safe mode that will get yur key for you
     
  3. Skunk141

    Skunk141 OSNN Addict

    Messages:
    98
    Won't boot and no safe mode :(
     
  4. fitz

    fitz Just Floating Along Staff Member Political User Folding Team

    Messages:
    4,076
    Location:
    Chicagoland
    not the easiest thing in the world to do, but if you have the ntuser.dat from the old machine you should be able to extract it..

    I suppose the easier thing might just be to ask why you can boot the old install and work from there.. but if you remain committed to pulling it from the old install without repairing it:

    1) Find the ntuser.dat file from the old machine (c:\documents and settings\<username>). If you don't know which ntuser.dat file contains the key, try them all..

    2) Grab a copy of LoadHive and run it and use it to select the ntuser.dat file (leave Loadhive running)

    3) start regedit.. browse to HKLM and look for a new subkey called NTUser.. HKLM\NTUser\Software\Microsoft\Windows NT\Current Version. (note: it may also be under HKLM\Software_00\Microsoft\Windows NT\Current Version)

    4) Open the DigitalProductID key

    5) Grab the information in bytes 52 through 66 (see example - you want the info marked with "1's" - also in bold and underlined.. note: your data will not be 1's but should be a series of hex data.
    6) Use the utility attached, input the hex code to decode the key.

    Alternative:

    Export the value that contains the DigitalProductID value to a file, edit that file to keep only the DigitalProductID value.. modify to import back to HKLM\Software\microsoft\Windows NT\Current Version

    Export your current HKLM\Software\Microsoft\Windows NT\CurrentVersion key

    Merge the reg from the old computer into HKLM\Software\Microsoft\Windows NT\CurrentVersion key

    Use the magic JellyBean to pull the key

    Reimport the original Reg key to restore the correct key

    I would still recommend using a test machine or use VMware/VirtualPC to setup a temporary computer and not your primary machine as it will change the key.
     
    Last edited: Apr 20, 2012
  5. Skunk141

    Skunk141 OSNN Addict

    Messages:
    98
    The hard disk is actually screwed so wont boot lots of clicking noises etc

    I am following your very helpful guide but after I load the ntuser.dat and go to the registry the location HKLM\NTUser\Software\Microsoft\Windows NT\Current Version or HKLM\Software_00\Microsoft\Windows NT\Current Version doesn't exist...

    Any ideas?

    EDIT: Just looking through the other user.dats will report back soon...
     
    Last edited: Jul 16, 2007
  6. fitz

    fitz Just Floating Along Staff Member Political User Folding Team

    Messages:
    4,076
    Location:
    Chicagoland
    when you selected the ntuser file, it should have given you a message stating where it loaded the hive. It also said, that clicking "OK" to that message will unload the registry file..

    so, two questions:

    1) Did you note the location of where loadhive loaded the registry?
    2) Did you leave that window/dialog box open since clicking "OK" to that message will unload the hive you are trying to connect to.
     
  7. Perris Calderon

    Perris Calderon Moderator Staff Member Political User

    Messages:
    12,333
    Location:
    new york
    belarc advisor will give you the key but when you use it again it won't work, you'll have to get permission from ms, which they always give
     
  8. Skunk141

    Skunk141 OSNN Addict

    Messages:
    98
    Fitz: yes and yes

    Just tried all the user.dat from all the user profiles and none of them have the DigitalProductID ??
     
  9. fitz

    fitz Just Floating Along Staff Member Political User Folding Team

    Messages:
    4,076
    Location:
    Chicagoland
    no sure the belarc advisor will work since it would give the current running machines key and not the dead machine.. unless you know something I don't. I only evaled the belarc advisor and never used it that heavily.


    edit:
    including the admin ntuser.dat file? Have you done a search on the drive that had the old install for ntuser.dat files and included all hidden/system files? Where did the loadhive tell you it mounted the registry?

    You mentioned the HKLM\ntuser key didn't exist.. did you manage to find it?
     
    ming likes this.
  10. Skunk141

    Skunk141 OSNN Addict

    Messages:
    98
    Yes I found the location but not the DigitalProductID in those locations, my post was a bit unclear.

    The loadhive is definantly working as it says is has loaded to HKEY_LOCAL_MACHINE\NTUSER and I can then find it...

    Checked all user including Admin just searching for other user.dat but hard disk is really clicking and losing power a lot now not sure ow much longer it will last.

    Thanks for your help
     
    Last edited: Jul 16, 2007
  11. Skunk141

    Skunk141 OSNN Addict

    Messages:
    98
    I have just had a break through, I loaded the hive %SystemRoot%\System32\Config\system and located the DigitalProductID in a folder called WPA, this has provided me with a key, just going to try it, will let you know in about an hour :)
     
  12. fitz

    fitz Just Floating Along Staff Member Political User Folding Team

    Messages:
    4,076
    Location:
    Chicagoland
    hmm.. yup.. apparently I have you the wrong hive to load..

    Maybe next time I should verify my memory :)
     
  13. Skunk141

    Skunk141 OSNN Addict

    Messages:
    98
    Well the code it gave me doesnt work! just comes up as invalid!!!

    arghhhhhh

    any ideas or im just going to have to load a stupid corp version and miss all the updates...
     
  14. LeeJend

    LeeJend Moderator

    Messages:
    5,291
    Location:
    Fort Worth, TX
    So you can read the HD, it just won't boot right?

    If the above recovery attempts fail as a last attempt reinstall the HD, set the bios to boot from CD and try and do a repair install from the CD. If that works then Jellybean should work. Also, back up all the system files to another machine so you can have them to try further recoveries before trying the repair install.

    As for getting an invalid key message for the one you have recovered are you sure that you are using the correct version CD to install? OEM, retail, PRO vs Corp, etc. If it is a slightly different version CD the key may not work with it.
     
    ming likes this.
  15. Skunk141

    Skunk141 OSNN Addict

    Messages:
    98
    Hard disk is shagged well and truly, no way will it will handle recovery, it took 15 mins pers ntuser.dat file after all its spin ups and crashing heads every 2 seconds.

    I cant remember what version of XP it had, not my main laptop, is there a way of checking, either way it is OEM and I have tried both Home and Pro discs and both are saying invalid key...

    Need a defiantive anwser of where the CD key is held in registry as ntuser.dat appears not to hold it and the one held in
    "system" hive only reports it in WPA folder...
     
  16. fitz

    fitz Just Floating Along Staff Member Political User Folding Team

    Messages:
    4,076
    Location:
    Chicagoland
    skunk, the key from the system file you sent me works fine.. sending you a PM with the CD key that was pulled from it.
     
  17. Skunk141

    Skunk141 OSNN Addict

    Messages:
    98
    just send you a message back, cant get it to work with either home or pro oem discs????
     
  18. Dark Atheist

    Dark Atheist Moderator Political User Folding Team

    Messages:
    6,376
    Location:
    In The Void
    prob not an oem key then
     
  19. Skunk141

    Skunk141 OSNN Addict

    Messages:
    98
    With a laptop with a sticker on the bottom, can't see fujitsu shipping retail versions?
     
  20. adaman

    adaman OSNN One Post Wonder

    Messages:
    1
    Check the Laptop Drive for more than one Partition. It may have a OS recovery partiotion you can copy to the new drive ther reinstall the OS.