Please experience, advice, Windows 10 on Bootcamp forgotten password.

My 84 year old father in law forgot his Windows 10 password it's on a Bootcamp partition on an iMac.

He moved several times from Big Bear to Hawaii, then back to So. Cal. so the windows installation is probably around a year old with no updates since. The iMac is up to date.

I have already booted up a Kali Live USB to attempt a chntpw, however all the folders and files on Bootcamp partition are locked with a little padlock symbol and not accessible by Linux.

I tried the restart from Windows login holding SHIFT to not create a hibernation file only change was the padlock symbol is gone now but all folders and files are still not accessible to Linux.

I booted into windows troubleshooting and attempted to boot into safe mode with command prompt to use chntpw, however it does not load into safe mode with command prompt with either 6 or F6.

Does anyone have any other ideas to make the folders and files accessible to Linux to use chntpw ?

Has anyone here run into this situation?

Appreciate any helpful advice, thank you.

Dave

 

I know on a typical Windows install using a LCD to boot from bypasses the security and you can manage files as needed. Bootcamp being embedded though might be a bit different or the security invoked by the Mac may prevent accessing the partition. If it's giving you problems booting up a different system and using the drive externally through a cable might get you into what you need.

 

Thank you, yes still a few options to try, I am finding a few mentions of "Input/Output error" which is the error I get under Kali Linux when trying to access the Bootcamp partition, that indicate it could be a NTSF file corruption or even hardware issue. I am going to try running Paragon free version on the Mac side to see if it helps.

 

IO errors mean disk failure is imminent. On the other hand it could be a bad cable / connector if we were talking about a desktop.

I use Paragon for quite a few things disk related and it's great. There are plenty of other linux modules you can use to recover data like dd / testdisk / other forensic tools that really get in there and grab data. I've used them in the past to make forensic copies of drives that weren't 100% any longer due to x/y/z changes made to them. They take a while to use though due to the sector by sector copying but, if it's on the disk you'll probably be able to get it off there.

 

Is he signed into a Microsoft account on that Windows partition? If the answer is positive, he could try to reset a password for his Microsoft acc on any other device. Then load that Windows partition on a Mac, connect to WiFi on the login page (for MS to pick up a new password) and enter the new password to have full access to all the files and the OS.

 

Thank you, I think he may have run who knows what utilities on it at some point thinking that would help, so I’m hoping it’s just NTFS issue that I can patch up.

Otherwise I’ll be looking at data recovery

 

That’s a great idea, he’s not sure but I’ll be looking into that as well.