Recovering a Windows XP Product Key

Mostly thanks to an article on Experts Exchange

Recently, data in the C:\Windows\System32\ directory (or "folder") of a client's computer became corrupted. The system would no longer boot - following the Windows start-up screen (with the cheesy little scrolling thingy), a blue-screen [of death] appeared, but was only displayed for the slightest fraction of an instant, as the PC rebooted immediately afterwards.

An OS reinstall might be required, but the client lost his installation CD and documentation referencing the Product Key, which is required for legitimate/licensed use of Windows XP. Instead of spending time and money getting Microsoft to provide a replacement Product Key, we decided to try and extract the license data from the corrupted drive, since it must be on there somewhere (intact, hopefully).

Here is the process I went through:

  1. The afflicted system needs to be booted from a source other than the corrupted disk (which no longer boots successfully). For example, "Windows PE (Preinstallation Environment)", or ERD from Winternals will allow you to boot from a CD. In my specific recent experience, there was a SCSI card in the machine. So, I hooked up a spare 9 GB Seagate SCSI drive, which my friend Mitch recently donated. I had not tried it out, and this experiment seemed like a good opportunity. I booted from a Windows XP install CD, and installed XP onto my spare SCSI drive, using a common/illegitimate Product Key (of course, this machine was not going onto the network as-such). In hindsight, I could have just taken the client's HD, and put it into another PC, but I also wanted to make sure that the rebooting was not a recently-developed hardware problem. Anyway, the point here is that you somehow boot up and have the drive with unbootable Windows XP installation accessible.
  2. I had obtained a "DOS-based cd key retriever", which I downloaded from the following address:

    From a command-line, I used this program to access the file \Windows\System32\config\software on the problematic drive (in my case, it came up as E:).
  3. Inside the registry file, the entry "\SOFTWARE\Microsoft\Windows NT\CurrentVersion" needs to be located and then exported. You may have to start browsing from an entry named $$$PROTO.HIV, and specify HKEY_LOCAL_MACHINE when you are asked to "Select root key". You will have to "Enter file name" to export to. In my case, I exported to a floppy from which I ran the RegViewer on the client's PC after booting from the SCSI disk.
  4. Using RegEdit on another [working] computer, export the same key (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion) to another file, for the purpose of retaining your original license data, which you are about to replace ;-)
  5. On that other [working] computer, double-click the .REG file you exported from the problematic drive (on the floppy I just used, in my case), and it will be imported into the registry of the working computer you are now using, replacing the same data you just exported.
  6. Now you can use KeyFinder by Magic Jellybean Software to display the Windows XP Product Key! Make note of it, as this was the goal.
  7. Having achieved the goal, double-click the second registry export (with the original license/key data of your working PC) to reimport it and restore/revert your tinkering.


Post a Comment

<< Home