User Guide

NTRecover
Winternals Software LP Page 1
1 Introduction
NTRecover is an advanced Windows NT/2000
©
dead-system recovery utility.
Windows NT/2000 machines that fail to boot because of data corruption,
improperly installed software or hardware, or faulty configuration, can be
accessed and recovered using standard administrative tools, such as
CHKDSK, with NTRecover.
NTRecover consists of host and client software, where the host software is
run on a functioning Windows NT or Windows 2000 system, and the client
software is executed on a target dead system. The host and client machines
must be connected with a standard null-modem serial cable.
The NTRecover host software creates virtual disk drives on the host machine
that represent the drives present on the client computer. When native file
systems, such as NTFS and FAT, access the drives, the NTRecover device
driver manages communications over the serial cable to the client software to
transfer disk data back and forth between the two machines. As far as
Windows NT/2000 on the host machine is concerned, the drives created by
NTRecover are indistinguishable from the local drives present on the host,
and so they can be manipulated with Windows NT/2000 disk utilities,
including high-level tools like the Windows NT Explorer, and low-level tools
such as CHKDSK.
When used in conjunction with Locksmith, NTRecover allows you to bypass
the security system and replace lost or forgotten administrative passwords.