Bit of a difficult one, extracting XP CD Key

[Skunk141]

I've got a laptop with the XP label underneath unreadable, I need to do a reload but obviously I need the CD Key, I have removed the hard disk and plugged it in to my PC so I can see the files, how can extract the XP CD Key?

I have found the jellybean keyfinder but as far as I can work out it only works on a current active program.

Hopefully some one can tell me a method of extraction of the key?

Cheers

 

[Dark Atheist]

dont know if this will work but you could give Yamicsoft WinXP Manager v5.1.5 a try, but you would have to place the drive back into the laptop same as jellybean not too sure, but if you can get the laptop to boot fully or into safe mode that will get yur key for you

 

[Skunk141]

Won't boot and no safe mode

 

[fitz]

not the easiest thing in the world to do, but if you have the ntuser.dat from the old machine you should be able to extract it..

I suppose the easier thing might just be to ask why you can boot the old install and work from there.. but if you remain committed to pulling it from the old install without repairing it:

1) Find the ntuser.dat file from the old machine (c:\documents and settings\<username>). If you don't know which ntuser.dat file contains the key, try them all..

2) Grab a copy of LoadHive and run it and use it to select the ntuser.dat file (leave Loadhive running)

3) start regedit.. browse to HKLM and look for a new subkey called NTUser.. HKLM\NTUser\Software\Microsoft\Windows NT\Current Version. (note: it may also be under HKLM\Software_00\Microsoft\Windows NT\Current Version)

4) Open the DigitalProductID key

5) Grab the information in bytes 52 through 66 (see example - you want the info marked with "1's" - also in bold and underlined.. note: your data will not be 1's but should be a series of hex data.

0000 00 00 00 00 00 00 00 00 ..
0008 00 00 00 00 00 00 00 00 ..
0010 00 00 00 00 00 00 00 00 ..
0018 00 00 00 00 00 00 00 00 ..
0020 00 00 00 00 00 00 00 00 ..
0028 00 00 00 00 00 00 00 00 ..
0030 00 00 00 00 11 11 11 11 ..
0038 11 11 11 11 11 11 11 11 ..
0040 11 11 11 00 00 00 00 00 ..
0048 00 00 00 00 00 00 00 00 ..
0050 00 00 00 00 00 00 00 00 ..

6) Use the utility attached, input the hex code to decode the key.

Alternative:

Export the value that contains the DigitalProductID value to a file, edit that file to keep only the DigitalProductID value.. modify to import back to HKLM\Software\microsoft\Windows NT\Current Version

Export your current HKLM\Software\Microsoft\Windows NT\CurrentVersion key

Merge the reg from the old computer into HKLM\Software\Microsoft\Windows NT\CurrentVersion key

Use the magic JellyBean to pull the key

Reimport the original Reg key to restore the correct key

I would still recommend using a test machine or use VMware/VirtualPC to setup a temporary computer and not your primary machine as it will change the key.

 

[Skunk141]

The hard disk is actually screwed so wont boot lots of clicking noises etc

I am following your very helpful guide but after I load the ntuser.dat and go to the registry the location HKLM\NTUser\Software\Microsoft\Windows NT\Current Version or HKLM\Software_00\Microsoft\Windows NT\Current Version doesn't exist...

Any ideas?

EDIT: Just looking through the other user.dats will report back soon...

 

[fitz]

when you selected the ntuser file, it should have given you a message stating where it loaded the hive. It also said, that clicking "OK" to that message will unload the registry file..

so, two questions:

1) Did you note the location of where loadhive loaded the registry?
2) Did you leave that window/dialog box open since clicking "OK" to that message will unload the hive you are trying to connect to.

 

[Perris Calderon]

when you selected the ntuser file, it should have given you a message stating where it loaded the hive. It also said, that clicking "OK" to that message will unload the registry file..

so, two questions:

1) Did you note the location of where loadhive loaded the registry?
2) Did you leave that window/dialog box open since clicking "OK" to that message will unload the hive you are trying to connect to.

belarc advisor will give you the key but when you use it again it won't work, you'll have to get permission from ms, which they always give

 

[Skunk141]

Fitz: yes and yes

Just tried all the user.dat from all the user profiles and none of them have the DigitalProductID ??

 

[fitz]

belarc advisor will give you the key but when you use it again it won't work, you'll have to get permission from ms, which they always give

no sure the belarc advisor will work since it would give the current running machines key and not the dead machine.. unless you know something I don't. I only evaled the belarc advisor and never used it that heavily.


edit:

Fitz: yes and yes

Just tried all the user.dat from all the user profiles and none of them have the DigitalProductID ??

including the admin ntuser.dat file? Have you done a search on the drive that had the old install for ntuser.dat files and included all hidden/system files? Where did the loadhive tell you it mounted the registry?

You mentioned the HKLM\ntuser key didn't exist.. did you manage to find it?

 

[Skunk141]

Yes I found the location but not the DigitalProductID in those locations, my post was a bit unclear.

The loadhive is definantly working as it says is has loaded to HKEY_LOCAL_MACHINE\NTUSER and I can then find it...

Checked all user including Admin just searching for other user.dat but hard disk is really clicking and losing power a lot now not sure ow much longer it will last.

Thanks for your help

 

[Skunk141]

I have just had a break through, I loaded the hive %SystemRoot%\System32\Config\system and located the DigitalProductID in a folder called WPA, this has provided me with a key, just going to try it, will let you know in about an hour

 

[fitz]

hmm.. yup.. apparently I have you the wrong hive to load..

Maybe next time I should verify my memory

 

[Skunk141]

Well the code it gave me doesnt work! just comes up as invalid!!!

arghhhhhh

any ideas or im just going to have to load a stupid corp version and miss all the updates...

 

[LeeJend]

So you can read the HD, it just won't boot right?

If the above recovery attempts fail as a last attempt reinstall the HD, set the bios to boot from CD and try and do a repair install from the CD. If that works then Jellybean should work. Also, back up all the system files to another machine so you can have them to try further recoveries before trying the repair install.

As for getting an invalid key message for the one you have recovered are you sure that you are using the correct version CD to install? OEM, retail, PRO vs Corp, etc. If it is a slightly different version CD the key may not work with it.

 

[Skunk141]

Hard disk is shagged well and truly, no way will it will handle recovery, it took 15 mins pers ntuser.dat file after all its spin ups and crashing heads every 2 seconds.

I cant remember what version of XP it had, not my main laptop, is there a way of checking, either way it is OEM and I have tried both Home and Pro discs and both are saying invalid key...

Need a defiantive anwser of where the CD key is held in registry as ntuser.dat appears not to hold it and the one held in
"system" hive only reports it in WPA folder...

 

[fitz]

skunk, the key from the system file you sent me works fine.. sending you a PM with the CD key that was pulled from it.

 

[Skunk141]

just send you a message back, cant get it to work with either home or pro oem discs????

 

[Dark Atheist]

prob not an oem key then

 

[Skunk141]

With a laptop with a sticker on the bottom, can't see fujitsu shipping retail versions?

 

[adaman]

Check the Laptop Drive for more than one Partition. It may have a OS recovery partiotion you can copy to the new drive ther reinstall the OS.