I purchased a used Dell Computer at an Estate Auction. I do not have the WinXP administrative password [sticker on P.C. tower reads: WinXP Pro]. I have a Linux Knoppix 5.1.1 live Cd.. and I am trying to delete the Sam File with the Knoppix Cd.. I have tried, without success, to mount the NTFS File System and change it to read-write. When doing so I receive one of two messages.
1. File/Files cannot be found.
2 Only root can do that.

Using the Knoppix XTerm
these are the commands/hash I used:
mount -o rw -t ntfs/dev/hda2 mnt/hda2
then I pressed enter and received the message "File/Files cannot be found".
I also used the command/hash:
cd /mnt/hda2/windows/system32
then pressed enter and recieved the message "Only root can do that"

If I click on the hda2 icon, it displays a Folder with the address of:
media/hda2
I have also tried using the media address but again I receive the same error messages.

Will someone post the correct commands that will change the NTFS files to read-write and also that will allow me to delete the
C:\windows\system32\config\Sam
and the
C:\windows\system32\config\Sam.log

Thanks

mount -t ntfs /dev/hda2 /getsam - this would be an typical mount command I would use for mounting a ntfs drive. getsam is the mount point so make that directory first. Instead of deleting \windows\system32\config\SAM I would copy it and \windows\system32\config\SYSTEM somewhere where you can access it. Then search for a Windows program called LC5. This is a password cracker and I have had good success using this. I have never deleting SAM before but it sounds risky.

Let me start from a different post.
"I just deleted the SAM file using Knoppix 5.1, here is the procedure:

Knoppix mounts the drive as read only, so you need to unmount it, then mount as read/write:

1. Open a shell ("Konsole")

2. Switch to user root by entering command "su" without quotes

3. Enter command "mount" (without quotes) and determine which device is your hard drive.
It will probably be at or near the end of the list, and mounted into the /media directory.
Take note of the device (example: /dev/sda1 ) and the mount point (example: /media/sda1 )

4. Assuming your hard drive is /dev/sda1 , you would unmount with this command:
umount /dev/sda1

5. Mount the drive with read-write access, to the same mount point you were using before:
mount /dev/sda1 /media/sda1 -o rw

Now you can remove any file you want, for example the SAM file:
rm /dev/sda1/WINDOWS/system32/config/SAM
"

I wouldn't delete the sam file.

I'd consider LOGINRECOVERY first.

Then I'd get knoppix-std or an old austrumi and use the password reset too.

Could consider a barts cd instead too.

- click on icon - mounts NTFS partition smoothly read-only
- right-click, to select change to read/write

As with knoppix you have to normally su in terminal and then passwd a new password. Then you can run stuff as root if it asks or you have to open a terminal, su then run the program.

I read it wrong and answer it wrong too. So get off my case you peanut.

Thanks for the info. Works great.