Windows XP and Vista Product Key Recovery

Image via CrunchBase

There are many programs available for extracting the product key from a Windows XP or Vista installation. The only problem is that they generally require the computer to be functional to run. These programs are useless if the operating system is corrupt and the computer will not boot into Windows. Fortunately, there are other options. This article explains how you can retrieve the product key with just the ntuser.dat file from the machine. You can also download a stand-alone version of my decrypter tool.

Windows Vista Users

I have been informed that this method also works on Windows Vista.

Translations

• Swedish translation of this article

Background Information

While this may not sound very useful to the average user, if you work with computers on a daily basis you have most likely ran into this problem: You have to perform a fresh installation of Windows on a computer with a corrupt operating system, and the product key has been lost. This method makes it easy to find.

Instructions

The first step is getting the ntuser.dat file from the computer. In most cases the easiest method is to remove the hard drive, and connect it to a working machine.
ntuser.dat is generally located here:
C:\Documents and Settings\(User Name)\ntuser.dat
Where (User Name) is the primary account - Most often it is ‘Owner’ or ‘User’
Now that you have the file, you need to be able to view it. I recommend loadhive.exe (Download it here) from matcode.com.
Just run the program and select the file. It will show you a message with more information. It is important that you do not close this program until you are finished viewing the registry, as it temporarily loads the file, and unloads it again when you exit.
Now run regedit. Under HKEY_LOCAL_MACHINE you will notice a new sub-key called NTUSER. Starting with NTUSER go to Software > Microsoft > Windows NT > Current Version.
In the right window, double-click on DigitalProductID. This is the entry that contains the encoded product key.
We want the information in bytes 52 to 66. You can use the chart below for reference. We need the 15 sets of numbers where the 1’s are located.

0000  00 00 00 00 00 00 00 00  ..0008  00 00 00 00 00 00 00 00  ..
0010  00 00 00 00 00 00 00 00  ..0018  00 00 00 00 00 00 00 00  ..
0020  00 00 00 00 00 00 00 00  ..0028  00 00 00 00 00 00 00 00  ..
0030  00 00 00 00 11 11 11 11  ..0038  11 11 11 11 11 11 11 11  ..
0040  11 11 11 00 00 00 00 00  ..0048  00 00 00 00 00 00 00 00  ..
0050  00 00 00 00 00 00 00 00  ..

Now that you have the 15 byte encrypted code, you can type it into my decrypter tool:

Web-based version

Windows XP Key Decrypter Tool

Downloadable stand-alone version (exe)

Windows XP Key Decrypter Tool

Just click ‘Decrypt Code‘ and you will have your 25 digit Windows XP product key!

Troubleshooting

If you cannot find the DigitalProductId key in the file you loaded earlier, try the software hive located here:

\%SystemRoot%\System32\config\software

Load it the same way as before. Under regedit, it will generally create the new entries here: HKEY_LOCAL_MACHINE\SOFTWARE_00 (although the loadhive program will tell you where it puts it).

Final Notes

• The decrypter tool ignores spaces and dashes, and is not case-sensitive.
  

• If you cannot find ntuser.dat, make sure you can view hidden and system files.


• If you are not sure which user account to select, I recommend searching for all ntuser.dat files on the drive, and using the largest one.


• Do not attempt to open your own ntuser.dat file with Load Hive, because it is already in use, and you already have access to your own registry


• If you cannot find the proper key with the data you need, try the alternate hive file, mentioned in the troubleshooting section above.