Recovering Outlook Express 6 Accounts, Address Books and Old Messages from a failed Win XP system using Windows 7 (Minus Passwords though)
Step 1 – Backup all Local and External Data:
First thing you will want to do before making any changes to both your system and the external files is to backup all the data. Make sure to create a restore point as well and export your registry if you are as paranoid about editing the system registry as I am. Never hurts to have multiple backups and Windows Restore Points can flake out for whatever reason it wants, so be sure to have your stuff in a safe place.
Why are they still using Outlook Express? Isn’t it insecure? : Back in the day, Windows XP would ship with Outlook Express as its default email client when installed in combination with Internet Explorer 4 or later. Most systems bought from a store were shipped with it installed by default but today it is left as an optional component from most OEM’s. While you can use web-mail such as Yahoo, Gmail and Hotmail, there are still a lot of us who like to use an email client to download them from these websites, instead of having to log on to each site individually. For Office uses, you probably use Outlook as your main email client, but for the average home users they still use Outlook Express and for that reason you will need to know how to support it and recover these files.
Step 2 – Identify what you need to recover:
While it is important to recover the email messages and contacts for most users, you may or may not have a need to recover their accounts and passwords. The thing to understand is that some users may not remember all their passwords and will not be able to access their email servers without a way to recover the account login info and passwords.
These are files on the users hard drive you will need to access in order to recover all their settings and messages.
1 – \\Documents and Settings\”username”\NTUSER.DAT
where “username” is the account you need to recover files from. NTUSER.DAT is the registry hive for this user and will contain their login information, such
as Account ID’s and Passwords. You will need to mount this hive file using Regedit in order to access the key which contains their passwords.
2- “HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager”
where “HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager” is the registry key from the NTUSER.DAT hive file containing their account info.
We’ll get to this in a second.
3 – \\Documents and Settings\”username”\Application Data\Microsoft\Address Book\”username.wab”
where “username.wab” is the users address book of contacts to import
4- \\Documents and Settings\”username”\Local Settings\Application Data\Identities\”{long hash key}”\Microsoft\Outlook Express\*.dbx
where “{long hash key}” is a unique hash value based on the users account and *.dbx are all the folders and email files for the account.
The dbx files can be stored in a different location, but the user would have to had specified this using Outlook Express.
Step 3 – Tools you will need to recover these files
1 - Notepad
2 – Regedit
3 – Windows Live Mail
http://download.live.com/wlmail
Step 4 – Setup Live Mail and recover their files:
Now that you know what files to access, we can begin by installing Windows Live Mail. Windows Live Mail is basically a clone of Outlook Express with a few fancy GUI changes to update with the times. Windows Live Mail also has some new features, such as a Calendar and RSS Feeds built in. Once you get it installed, you will be prompted to add a user. You can cancel this and then go to the main interface. Hit the alt key to see the file menus or click the icon on the right side of the ribbon to select the show menu bar option.
Now that you can see the file menu options you can begin your imports. Everything except the accounts can easily be recovered at this point just by access the WAB and DBX files. On the file menu, select Go > Contacts. Once the contact window opens, hit the alt key and then File > Import >WAB files. This will add all the contacts to your address book from Outlook Express’s WAB file.
Note: Remember that it is located on the users drive in [Documents and Settings\"username"\Application Data\Microsoft\Address Book\"username.wab"]
Once you have added their contacts, you will want to import their messages and folder structure from their inbox. For this, we close the contact window and go back to the main screen. Click File > Import > Messages > Outlook Express 6 Messages. You will then point to their DBX files, located in [Documents and Settings\"username"\Local Settings\Application Data\Identities\"{long hash key}"\Microsoft\Outlook Express\].
At this point, you may be done. Depending on whether or not the user has their account names, passwords and servers documented, they may be able to handle setting up the rest. If not, now comes the fun part.
Step 5 – Mounting the Hive to Export their Account Details
NOTE: This is another reason you were asked to make a backup of your own as well as their files, in the event that a catastrophic failure happens at this point, you may not be able to recover your’s or their files.
If you need to recover their accounts, you will need to mount their Registry Hive file. Open Regedit and then select the “HKEY_LOCAL_MACHINE” tree. From the file menu, select File > Load Hive and point to the [Documents and Settings\"username"\NTUSER.DAT] file I mentioned above. Once you do this, you will be loading all their reg keys for that users sign-on. You will then want to navigate to the key ["HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager"] Double click this and you will see a folder called Accounts. Right click Accounts and then select Export. Save the file to your desktop as OutlookAccounts.reg.
Whatever you do at this point, DO NOT DOUBLE CLICK or MERGE this file with your registry! Once the export is done, you can unload the Hive file. THIS IS ALSO IMPORTANT! BE SURE TO SELECT ONLY THE FILE YOU LOADED! DO NOT UNLOAD ANY OTHER HIVES OR KEYS OR YOU COULD MESS UP YOUR CURRENT SYSTEM!
Now that you have this file on your desktop, you can open it in notepad.
[ Again, do not try to merge this with your system as the keys they point to are not in the same paths as your current machine and wont do you any good anyway! ]
For every line that says Account Name, there is an email account associated with it. There will be multiple sections depending on how may accounts the user had in their Outlook Express Client. You will also notice that there are plain text listings of the email addresses in each Account Name section, as well as their email servers POP and SMTP addresses.
ex:
“Account Name” Can be anything, but usually is their email address or ISP name.
“POP3 Server” ex: mail.server.com or pop3.server.com, etc..
“POP3 User Name” (Should be their email address but may be blank if they never set one up properly)
“SMTP Server” ex: smtp.server.com or mail.server.com, etc..
From here, you will have to document the email addresses and servers they are associated with. You can then add them manually to the new system through Windows Live Mail, but you still won’t have a password for these accounts.
Alternatively if you have a Virtual Machine with XP installed, you can create a new user, then overwrite their NTUSER.DAT file and then open Outlook Express to see the accounts. This will yield you the ability to see all the accounts within Outlook Express and then export them easily, but understand that their PASSWORDS WILL NOT WORK with this method. The password hashes in the NTUSER.DAT file are protected via a salt which is unique to the original operating systems SID. If this salt and hash combo aren’t able to be decrypted in the VM, then when you export the .iaf files the passwords will not be correct and will be set as the same field as your email address. Normally the .iaf file will contain the password for bringing these accounts to a new machine for migration, but since the hash cant be decoded from the VM, it is not able to store them for you.
Step 6 – Password Recovery Not Possible from NTUSER.DAT alone
At this point, you have all the information you need to get their accounts entered, but you won’t have any of their passwords. As far as I know, there isn’t a way to merge the reg file into Windows 7 or any other windows machine for that matter to yield you these passwords. Normally Under XP You could run a tool like Cain to dump the Protected Storage which contains the passwords for all your email accounts. Merging our exported hive key to any system would still not show you any results. The reason being is that your system creates a unique Identity, or a hash called a SID when you install windows. Because of that, our identity hash and sid are different for every system.
After a little research I found a tool that let syou retreived the passwords directly from the NTUSER.DAT files. This little tool does eactly what it says it does, but is not free. If you are PC Repair Technician, this is a great tool to add to your arsenal, even if only a paid for program since Microsoft does not seem to have a free tool for doing exactly that:
http://www.passcape.com/outlook_express_password_recovery
For the price of the tool, I think its probably worth having. If you happen to find a tool that works just as well, then please left me know and I can update this post with a link to the other tools. I have tried things like Nirsofts password recovery toold, but they dont seem to have a way to read a raw NTUSER.DAT file for recovering the keys, and only work from within a currently stable system, not from the files off a dead system.
del.icio.us|Digg|Furl|ma.gnolia|RawSugar|reddit|Spurl|Google|StumbleUpon
