Recover Windows XP Product Key from ntuser.dat in Corrupted or Unbootable System
Product key, or used to more commonly known as CD key or serial number for Windows XP is as good as the license to use the operating system. Although you may have the paper license for the OS, however due to introduction of Windows Genuine Advantage (WGA) anti piracy feature (see ways to bypass), if Windows XP is installed with invalid or wrong product key, the users will be subjected to much annoyance. Thus if you don’t record down the product key, the product key may be lost once you reformat or reinstall Windows, or the computer corrupts and unbootable.
There are plenty of ways and tools that can be used to retrieve product key from Windows XP, as long as you can still manage to boot and log on to Windows. If Windows corrupted, hard disk corrupted, system no longer functional or computer no longer able to boot up, the tricks will not be able to work. In the case where you need to recover a lost product key from an inaccessible Windows environment, utility by Dagon Design may be useful.
Instructions
The first step is getting the ntuser.dat file from the computer. In most cases the easiest method is to remove the hard drive, and connect it to a working machine.
ntuser.dat is generally located here:
C:\Documents and Settings\(User Name)\ntuser.dat
Where (User Name) is the primary account – Most often it is ‘Owner’ or ‘User’Now that you have the file, you need to be able to view it. I recommend loadhive.exe (Download it here) from matcode.com.
Just run the program and select the file. It will show you a message with more information. It is important that you do not close this program until you are finished viewing the registry, as it temporarily loads the file, and unloads it again when you exit.
Now run regedit. Under HKEY_LOCAL_MACHINE you will notice a new sub-key called NTUSER. Starting with NTUSER go to Software > Microsoft > Windows NT > Current Version.
In the right window, double-click on DigitalProductID. This is the entry that contains the encoded product key.
We want the information in bytes 52 to 66. You can use the chart below for reference. We need the 15 sets of numbers where the 1’s are located.
0000 00 00 00 00 00 00 00 00 ..
0008 00 00 00 00 00 00 00 00 ..
0010 00 00 00 00 00 00 00 00 ..
0018 00 00 00 00 00 00 00 00 ..
0020 00 00 00 00 00 00 00 00 ..
0028 00 00 00 00 00 00 00 00 ..
0030 00 00 00 00 11 11 11 11 ..
0038 11 11 11 11 11 11 11 11 ..
0040 11 11 11 00 00 00 00 00 ..
0048 00 00 00 00 00 00 00 00 ..
0050 00 00 00 00 00 00 00 00 ..Now that you have the 15 byte encrypted code, you can type it into my decrypter tool:
Web-based version
Downloadable stand-alone version (exe)
Just click ‘Decrypt Code‘ and you will have your 25 digit Windows XP product key!
Troubleshooting
If you cannot find the DigitalProductId key in the file you loaded earlier, try the software hive located here:
\%SystemRoot%\System32\config\software
Load it the same way as before. Under regedit, it will generally create the new entries here: HKEY_LOCAL_MACHINE\SOFTWARE_00 (although the loadhive program will tell you where it puts it).
Related Articles
- Free Produkey v1.32 Utility to Recover Product Key of Windows/MS-Office/SQL Server
- How to Recover from (Remove) Windows 7 Frankenbuild PlusPatch Crack or Orbit30 Activator to Activate with Genuine Product Key
- Easily Change Product Key with Windows Product Key Update Tool Free Download
- Gmail Email Message Corrupted Error
- Recover Keys Free Download to Retrieve Lost Product Keys or Serial Numbers
- Windows Key Checker to Log and Record Vista and XP Product CD Serial Key
- How to Update and Change Windows XP Product Key Manually
- Almeza MultiSet 6.3 (nLite and vLite Alternative to Build Custom Windows XP and Vista Imge) Free Product Key by GOTD
- The Product Key Is Not Valid Or 0xC004F061 Activation Error On Windows 7 Upgrade
- Retrieve and Recover Wireless Network Security Key (WEP or WPA) in Windows with WirelessKeyView
Entries (RSS)
April 1st, 2009 16:59
Tried both methods – ntuser.dat and the config folder – hives loaded ok in both cases – but no key found. Could find the key and decrypt it for my working machine ok. I guess I’ve had it unless anyone can come up with another bright idea.
Despite this – a brilliant post – will definitely add it to my arsenal of ‘useful stuff’.
January 31st, 2009 01:13
I’m curious. Loading a hive is easy. It’s like one or two API calls. Finding the key programmatically is also fairly easy. The hard part was decrypting the original key – which is the part you’ve done.
Why not add the first two steps right into your app so the user doesn’t have to use three apps and have to remember all these details?
Just a thought.
April 18th, 2008 09:00
This is one kickass time saver. My hat is off to you and I am indebted to you. I’ve been looking for such a tool for a long time. Great job.
January 19th, 2008 13:02
Just wanted to say thanks Jinx – that was a life saver I really thought I was lost till I was your post.
And thanks for the original article!!
January 3rd, 2008 19:02
Nahh this isnt how you do it for all systems,its close tho. I couldnt locate my key thru the ntuser.dat(XP HOME), I had to use a different file. the software file inside the \windows\system32\config folder.
So for me I cannot boot my drive, so I stick it in a second computer (working) and can read the drive (aka non damaged disk, just unbootable)
first go get the loadhive program and run it, go to the unbootable drive and find the software file in the config dir. Not the .sav or .LOG files, the one without the extension. Load it as stated by the guy above and follow the rest of his instructions.
April 21st, 2007 07:46
this is good stuff, for years iv been trying to format pcs but cudnt coz they didnt have their keys.
the hard part is getting into documnts and settings (sumtimes ucant cos it protected)
and a downside is u have to open the pc to take out the HDD, but hey its worth it!