Bit of a difficult one, extracting XP CD Key

Skunk141

OSNN Addict
Joined
6 Jan 2004
Messages
98
I've got a laptop with the XP label underneath unreadable, I need to do a reload but obviously I need the CD Key, I have removed the hard disk and plugged it in to my PC so I can see the files, how can extract the XP CD Key?

I have found the jellybean keyfinder but as far as I can work out it only works on a current active program.

Hopefully some one can tell me a method of extraction of the key?

Cheers

:)
 

Dark Atheist

OSNN Veteran Addict
Political Access
Joined
8 Apr 2003
Messages
6,376
dont know if this will work but you could give Yamicsoft WinXP Manager v5.1.5 a try, but you would have to place the drive back into the laptop same as jellybean not too sure, but if you can get the laptop to boot fully or into safe mode that will get yur key for you
 

fitz

Woah.. I'm still here?
Political Access
Joined
26 Apr 2004
Messages
4,084
not the easiest thing in the world to do, but if you have the ntuser.dat from the old machine you should be able to extract it..

I suppose the easier thing might just be to ask why you can boot the old install and work from there.. but if you remain committed to pulling it from the old install without repairing it:

1) Find the ntuser.dat file from the old machine (c:\documents and settings\<username>). If you don't know which ntuser.dat file contains the key, try them all..

2) Grab a copy of LoadHive and run it and use it to select the ntuser.dat file (leave Loadhive running)

3) start regedit.. browse to HKLM and look for a new subkey called NTUser.. HKLM\NTUser\Software\Microsoft\Windows NT\Current Version. (note: it may also be under HKLM\Software_00\Microsoft\Windows NT\Current Version)

4) Open the DigitalProductID key

5) Grab the information in bytes 52 through 66 (see example - you want the info marked with "1's" - also in bold and underlined.. note: your data will not be 1's but should be a series of hex data.
0000 00 00 00 00 00 00 00 00 ..
0008 00 00 00 00 00 00 00 00 ..
0010 00 00 00 00 00 00 00 00 ..
0018 00 00 00 00 00 00 00 00 ..
0020 00 00 00 00 00 00 00 00 ..
0028 00 00 00 00 00 00 00 00 ..
0030 00 00 00 00 11 11 11 11 ..
0038 11 11 11 11 11 11 11 11 ..
0040 11 11 11 00 00 00 00 00 ..
0048 00 00 00 00 00 00 00 00 ..
0050 00 00 00 00 00 00 00 00 ..

6) Use the utility attached, input the hex code to decode the key.

Alternative:

Export the value that contains the DigitalProductID value to a file, edit that file to keep only the DigitalProductID value.. modify to import back to HKLM\Software\microsoft\Windows NT\Current Version

Export your current HKLM\Software\Microsoft\Windows NT\CurrentVersion key

Merge the reg from the old computer into HKLM\Software\Microsoft\Windows NT\CurrentVersion key

Use the magic JellyBean to pull the key

Reimport the original Reg key to restore the correct key

I would still recommend using a test machine or use VMware/VirtualPC to setup a temporary computer and not your primary machine as it will change the key.
 
Last edited:

Skunk141

OSNN Addict
Joined
6 Jan 2004
Messages
98
The hard disk is actually screwed so wont boot lots of clicking noises etc

I am following your very helpful guide but after I load the ntuser.dat and go to the registry the location HKLM\NTUser\Software\Microsoft\Windows NT\Current Version or HKLM\Software_00\Microsoft\Windows NT\Current Version doesn't exist...

Any ideas?

EDIT: Just looking through the other user.dats will report back soon...
 
Last edited:

fitz

Woah.. I'm still here?
Political Access
Joined
26 Apr 2004
Messages
4,084
when you selected the ntuser file, it should have given you a message stating where it loaded the hive. It also said, that clicking "OK" to that message will unload the registry file..

so, two questions:

1) Did you note the location of where loadhive loaded the registry?
2) Did you leave that window/dialog box open since clicking "OK" to that message will unload the hive you are trying to connect to.
 

Perris Calderon

dealer
Staff member
Political Access
Joined
24 Jan 2002
Messages
12,375
when you selected the ntuser file, it should have given you a message stating where it loaded the hive. It also said, that clicking "OK" to that message will unload the registry file..

so, two questions:

1) Did you note the location of where loadhive loaded the registry?
2) Did you leave that window/dialog box open since clicking "OK" to that message will unload the hive you are trying to connect to.
belarc advisor will give you the key but when you use it again it won't work, you'll have to get permission from ms, which they always give
 

Skunk141

OSNN Addict
Joined
6 Jan 2004
Messages
98
Fitz: yes and yes

Just tried all the user.dat from all the user profiles and none of them have the DigitalProductID ??
 

fitz

Woah.. I'm still here?
Political Access
Joined
26 Apr 2004
Messages
4,084
belarc advisor will give you the key but when you use it again it won't work, you'll have to get permission from ms, which they always give

no sure the belarc advisor will work since it would give the current running machines key and not the dead machine.. unless you know something I don't. I only evaled the belarc advisor and never used it that heavily.


edit:
Fitz: yes and yes

Just tried all the user.dat from all the user profiles and none of them have the DigitalProductID ??

including the admin ntuser.dat file? Have you done a search on the drive that had the old install for ntuser.dat files and included all hidden/system files? Where did the loadhive tell you it mounted the registry?

You mentioned the HKLM\ntuser key didn't exist.. did you manage to find it?
 

Skunk141

OSNN Addict
Joined
6 Jan 2004
Messages
98
Yes I found the location but not the DigitalProductID in those locations, my post was a bit unclear.

The loadhive is definantly working as it says is has loaded to HKEY_LOCAL_MACHINE\NTUSER and I can then find it...

Checked all user including Admin just searching for other user.dat but hard disk is really clicking and losing power a lot now not sure ow much longer it will last.

Thanks for your help
 
Last edited:

Skunk141

OSNN Addict
Joined
6 Jan 2004
Messages
98
I have just had a break through, I loaded the hive %SystemRoot%\System32\Config\system and located the DigitalProductID in a folder called WPA, this has provided me with a key, just going to try it, will let you know in about an hour :)
 

fitz

Woah.. I'm still here?
Political Access
Joined
26 Apr 2004
Messages
4,084
hmm.. yup.. apparently I have you the wrong hive to load..

Maybe next time I should verify my memory :)
 

Skunk141

OSNN Addict
Joined
6 Jan 2004
Messages
98
Well the code it gave me doesnt work! just comes up as invalid!!!

arghhhhhh

any ideas or im just going to have to load a stupid corp version and miss all the updates...
 

LeeJend

OSNN Veteran Addict
Joined
25 Jan 2003
Messages
5,291
So you can read the HD, it just won't boot right?

If the above recovery attempts fail as a last attempt reinstall the HD, set the bios to boot from CD and try and do a repair install from the CD. If that works then Jellybean should work. Also, back up all the system files to another machine so you can have them to try further recoveries before trying the repair install.

As for getting an invalid key message for the one you have recovered are you sure that you are using the correct version CD to install? OEM, retail, PRO vs Corp, etc. If it is a slightly different version CD the key may not work with it.
 

Skunk141

OSNN Addict
Joined
6 Jan 2004
Messages
98
Hard disk is shagged well and truly, no way will it will handle recovery, it took 15 mins pers ntuser.dat file after all its spin ups and crashing heads every 2 seconds.

I cant remember what version of XP it had, not my main laptop, is there a way of checking, either way it is OEM and I have tried both Home and Pro discs and both are saying invalid key...

Need a defiantive anwser of where the CD key is held in registry as ntuser.dat appears not to hold it and the one held in
"system" hive only reports it in WPA folder...
 

fitz

Woah.. I'm still here?
Political Access
Joined
26 Apr 2004
Messages
4,084
skunk, the key from the system file you sent me works fine.. sending you a PM with the CD key that was pulled from it.
 

Skunk141

OSNN Addict
Joined
6 Jan 2004
Messages
98
just send you a message back, cant get it to work with either home or pro oem discs????
 

Skunk141

OSNN Addict
Joined
6 Jan 2004
Messages
98
With a laptop with a sticker on the bottom, can't see fujitsu shipping retail versions?
 

adaman

OSNN One Post Wonder
Joined
17 Jul 2007
Messages
1
Check the Laptop Drive for more than one Partition. It may have a OS recovery partiotion you can copy to the new drive ther reinstall the OS.
 

Members online

No members online now.

Latest profile posts

hello peeps... is been some time since i last came here.
Electronic Punk wrote on Sazar's profile.
Rest in peace my friend, been trying to find you and finally did in the worst way imaginable.
Terrahertz wrote on Electronic Punk's profile.
Yo fellas!
Electronic Punk wrote on Sazar's profile.
Where are you buddy?
Perris Calderon wrote on Electronic Punk's profile.
Hey EP! All good with me, applying for Microsoft MVP right now, should have done this a while ago.

Notifications don't work, I only found your response by coming back to hunt up some threads, if you want, give me your email address so we can keep in touch easier!

Forum statistics

Threads
62,000
Messages
673,425
Members
5,593
Latest member
moussa021