Windows 10: Rescuing Users files on a corrupt HD and the security implications

My friend's computer HD developed corrupt blocks and we could not do a restore or repair. I booted off a linux live USB stick and to my surprise was able to get access to all of my friends files and their contents but also to my relief as this meant her work was not lost.
I say surprise because I was of the understanding that these files were only accessible to the account owner but here I was with a linux usb and having full access to those files and viewing their contents. This means that I can so the same with anyones computer? How can this be? Am I not understanding how accounts and security works on Win10 systems. I thought that files and folders belonging to an account could not be viewed by anyone who didn't have the correct password. TBH what happens when someone experiences what my friend did hadn't crossed my mind with regards to how they get back their work.

After replacing the HD with an SSD and installing Win10 I connected up the HD and copied across the users complete account folder to the SSD, viewed it's files and contents and then switched off. Today when I navigate to the user's folder on the SSD everything is gone, vanished?!

Can someone please explain what is going on?

:)

 

How can I remove the password requirement for windows 10?

You can just ask a question, but you need to be aware of the security and on-line safety implications (not just for you but for the on-line community in general) of not having a password protected User account.

 

1607 upgrade has left my PC with a flashing cursor

Finally located the rescue disk and was able to get my system back, albeit with a few corrupted system files. Now have a full system image and the product key in case I need it in future.

I've also set the metered connection option to prevent forced installs, so for now I'll stay with 1511.

Microsoft should seriously give thought to its method of maintaining security without imposing unstable software updates on users.

 

Booting a Linux LiveDVD bypasses the Windows security features, I use it several times a month. I move the files to a different drive using an adapter plugged into the USB port. Most times it's a Thermaltake BlacX box that accommodates both the 2.5" and 3.5" SATA drives. For PATA drives I use a product with cables, adapters and a power supply instead of putting into a box.

 

But in the second instance I wasn't using a Linux usb it was a new Win10 installation and I could explore the directory structure and file contents of that users account on the defunct HD, where was Windows security in this case?

Are you telling me I can do the same on any Windows installation using a Linux live usb?

I'm shocked *Eek

 

1. The new install did not have the security settings from the old drive. 2. Probably, I have done it with a Linux LiveDVD, haven't tried with the USB version.

It's usually the individual files that are protected that given me a problem such as a database file that has a password needed so it could be opened.

 

So let me get this straight.

I can access another users files and have full access on a Win10 OS if I use Linux live to boot up?
On the new Win10 install can I connect the old drive via usb and copy over the users folder and have full access or not, that's the issue for me nothing else?

You mentioned ...
1. The new install did not have the security settings from the old drive.

Yes I know but I was still able to access stuff as if it did. Sorry I'm confused what question are you answering here.

You also said...
Most times it's a Thermaltake BlacX box that accommodates both the 2.5" and 3.5" SATA drives. For PATA drives I use a product with cables, adapters and a power supply instead of putting into a box.

Again I'm not sure why you mentioned this, is this relevant to the post or am I missing something?

 

Just giving an alternate way I use to recover files as sometimes an HDD failure can be attributed to other hardware issues.

 

Okay, thanks.

 

Is there still an issue where everything is gone, vanished?!

Berton explained some of the nitty-gritty re: accessing a disk with different OSes (or even a different instance of the same OS). A disk can be accessed by any machine it is attached if the file system on the disk is supported. Basic file system security is managed by the OS.

 

Maybe Berton's posts had an answer but I'm afraid I didn't see it so ending up getting nowhere. I did post on another forum and got more or less the same info you've just posted. But they clarified it further by saying that I need to copy across files and not folders as simply copying across folders would not work. No reason was given as to why. This is going to be very tedious as there are many layers of directories within the user's account.

 

So yes is the answer to Is there still an issue where everything is gone, vanished?!

If you're up to it, try this:

Create a folder on C:\ named !_Gusgf
Answer YES to the UAC if prompted
** any folder name would do, but I tried to come up with a name and location that should not interfere
Navigate to the folder C:\!_Gusgf

Launch another File Explorer (Ctrl+N should do it)
Navigate to the HDD with the user data you want to recover

Select one of the user folders (Downloads, Documents, Music, Pictures, Videos) - just one .. the one with the least data
Ctrl+C

Return to the File Explorer with C:\!_Gusgf open
Ctrl+V

log out
shut down the machine and start it back up (don't do a restart - do a cold start)

Check C:\!_Gusgf for the folder you copied

I can't think of any reason that the folders/files you previously copied would just disappear.
The test above mimics what you did, but only copying one folder - if that's gone, then something is obviously wrong.

If that folder still exists after the cold start
I'll use Pictures as an example

Try searching the SSD (C:\ ?? )
Navigate to C:\

copy the following query and paste it into the search box

Pictures kind:=folder
sort the results by Folder to make it easier (I add Folder path and sort by that)
Is there a Pictures folder from the original copy (as well as the one you copied for this test and the ones that were created during the install and user account setup) somewhere on the drive?

Why do this? Because it's common to copy something somewhere and think it was copied somewhere else. I've done it lots of times, especially with drag-and-drop copies using a touchpad. The drag ends before getting to the desired location and the drop puts it wherever the drag stopped. You can look at the folders/files - but when you come back later the stuff isn't where you think you put it.

Just guessing what might have occurred based on my own experiences with mysteries like this

 

Standard file security is based on the OS's Filesystem security. A Linux (or even another Windows computer) can, by default, read, write, delete, etc anything.

The first rule of security is that if you have physical access to the machine (ie, if you can take out the hard drive or boot from another drive) then you don't have any security. The security only works with the OS itself.

There are, however, ways to improve that security. For instance, you can use folder encryption which will prevent the files from being readable by any user account other than the user that created them. There is all full-disk encryption, with Bitlocker and a few other tools that prevent the entire drive from being accessed if you do not have the right security key.

 

Thanks to everyone for their contributions. I have managed to copy the data across from the old drive to the ssd by simply selecting the folders nested beneath the user account directory. Originally I'd just copied the whole user account directory and when I'd rebooted the directory was still there taking up 7GB but when I drilled down into it there was one small file and and empty directory (hidden files etc was set to display). So not sure what was going on there.

But all is sorted now and thanks for all the contributions *Smile

 

Yes that is something I'd not been aware of and I'm sure 95% of Windows users out there haven't a clue either, kind of frightening really. I will be looking at folder encryption for sure. First port of call will be bitlocker.