My external HDD got broken. It was formatted with NTFS.

In one of the files I had my login and password stored in plain text. Is there any possibility to find this password by looking for the username through all the blocks on the hard drive?

Ontrack easy recovery found some files, but unfortunately it is not able to find source code or text files.

  • It should be possible so long as the username/password were stored in plain text (as you've mentioned) and that the file they were in is accessible. – slm Nov 23 '14 at 15:54
  • 1
    Is the partition table borked? fdisk to recreate it and then this to find the data...I would also make an image copy using dd before doing any of that though. You might also want to check out TestDisk – SailorCire Nov 23 '14 at 15:58
  • Master file table is completly broken. I recreated partition table with testdisk, but no way to recreate mft – peku33 Nov 23 '14 at 16:05
  • Just a security related comment.....Why? I'll presume it is windows (you didn't say), you can always reset the password from one of the admin priv'd accounts. Easier to change your password in Linux. And even then, if you forget your password to get in, how does having it in PLAIN text help you? This is confusing, and very strange to say the least. – mdpc Nov 23 '14 at 20:07
  • Because it's not password to windows – peku33 Nov 24 '14 at 17:08

You can run strings as root on your filesystem:

sudo strings -n 6 /dev/sda

Adjust the number 6 to the minimum of the lengths of your login name and password (smaller number gives more stuff to wade through).

You can store the output to a file and search through that, or directly pipe into grep with before and after lines displayed:

sudo strings -n 6 /dev/sda | grep -A 5 -B 5 loginname

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.