Microsoft

   1 PS C:\Windows\system32> wmic path softwarelicensingservice get OA3xOriginalProductKey
   2 OA3xOriginalProductKey
   3 AAAAA-BBBBB-CCCCC-DDDDD-EEEEE

   1 apt install chntpw ntfs-3g

   1 mkdir /mnt/windows
   2 mount /dev/sdb2 /mnt/windows
   3 cd /mnt/windows
   4 ls -la
   5 cd Windows/System32/config/
   6 chntpw -L SAM
   7 chntpw -i SAM
   8 cd /
   9 umount /mnt/windows

   1 # mount -o rw /media/data
   2 The disk contains an unclean file system (0, 0).
   3 Metadata kept in Windows cache, refused to mount.
   4 Falling back to read-only mount because the NTFS partition is in an
   5 unsafe state. Please resume and shutdown Windows fully (no hibernation
   6 or fast restarting.)
   7 Could not mount read-write, trying read-only

   1 # mount | grep data     
   2 /dev/sdb1 on /media/data type fuseblk (ro,nosuid,nodev,noexec,relatime,user_id=0,group_id=0,allow_other,blksize=4096,user)
   3 # umount /media/data
   4 # ntfsfix /dev/sdb1
   5 Mounting volume... The disk contains an unclean file system (0, 0).
   6 Metadata kept in Windows cache, refused to mount.
   7 FAILED
   8 Attempting to correct errors... 
   9 Processing $MFT and $MFTMirr...
  10 Reading $MFT... OK
  11 Reading $MFTMirr... OK
  12 Comparing $MFTMirr to $MFT... OK
  13 Processing of $MFT and $MFTMirr completed successfully.
  14 Setting required flags on partition... OK
  15 Going to empty the journal ($LogFile)... OK
  16 Checking the alternate boot sector... OK
  17 NTFS volume version is 3.1.
  18 NTFS partition /dev/sdb1 was processed successfully.
  19 # mount -o rw /media/data
  20 

   1 lsblk| grep sd   
   2 sda           8:0    0   7,3T  0 disk 
   3 └─sda1        8:1    0   7,3T  0 part /media/space
   4 sdb           8:16   0   7,3T  0 disk 
   5 └─sdb1        8:17   0   7,3T  0 part 
   6 sdc           8:32   1 119,3G  0 disk

   1 parted /dev/sdc
   2 GNU Parted 3.4
   3 Using /dev/sdc
   4 Welcome to GNU Parted! Type 'help' to view a list of commands.
   5 (parted) unit MiB
   6 (parted) print free
   7 Model: SanDisk Extreme Pro (scsi)
   8 Disk /dev/sdc: 122112MiB
   9 Sector size (logical/physical): 512B/512B
  10 Partition Table: msdos
  11 Disk Flags: 
  12 
  13 Number  Start      End        Size       Type     File system  Flags
  14         0,00MiB    1,00MiB    1,00MiB             Free Space
  15  1      1,00MiB    122111MiB  122110MiB  primary  udf
  16         122111MiB  122112MiB  1,00MiB             Free Space
  17 
  18 (parted) mktable gpt
  19 Warning: The existing disk label on /dev/sdc will be destroyed and all data on this disk will be lost. Do you want to continue?
  20 Yes/No? yes
  21 (parted) mkpart primary 1 -1
  22 (parted) quit
  23 Information: You may need to update /etc/fstab.

   1 LABEL="Win10"
   2 mkfs.vfat -n "$LABEL" /dev/sdc1

   1 [ "$LABEL" ] && mkdir "/media/$LABEL"
   2 mount /dev/sdc1 "/media/$LABEL"
   3 ### CHANGE DIR TO THE DIRECTORY WITH THE WINDOWS IMAGE AND MOUNT IT
   4 mount Win10_21H1_German_x64.iso /mnt
   5 mount: /mnt: WARNING: source write-protected, mounted read-only.

   1 ### RSYNC THE CONTENT (FAILS JUST FOR DEMONSTRATION)
   2 rsync -rltD /mnt/ "/media/$LABEL"
   3 rsync: [receiver] write failed on "/media/Win10/sources/install.wim": File too large (27)
   4 rsync error: error in file IO (code 11) at receiver.c(378) [receiver=3.2.3]
   5 rsync: [sender] write error: Broken pipe (32)

   1 [ "$LABEL" ] && mkdir "/tmp/$LABEL"
   2 rsync -rltD /mnt/ "/tmp/$LABEL"
   3 ### INSTALL wimtools
   4 ### Tools for manipulating Windows Imaging files
   5 apt install wimtools
   6 wimlib-imagex optimize "/tmp/$LABEL/sources/install.wim" --solid
   7 "/tmp/Win10/sources/install.wim" original size: 4805651 KiB
   8 Using LZMS compression with 32 threads
   9 Archiving file data: 9 GiB of 9 GiB (100%) done
  10 "/tmp/Win10/sources/install.wim" optimized size: 3611026 KiB
  11 Space saved: 1194624 KiB
  12 wimlib-imagex optimize "/tmp/$LABEL/sources/install.wim" --solid  10824,21s user 53,19s system 2343% cpu 7:44,17 total
  13 rsync -rltD /tmp/Win10/ "/media/$LABEL"
  14 #### rsync -rltD /tmp/Win10/ "/media/$LABEL"  1,44s user 6,07s system 127% cpu 5,912 total
  15 

   1 ### WAIT FOR THE BUFFERS TO BE WRITEN
   2 sync
   3 ### UNMOUNT ANYTHING
   4 umount /mnt
   5 umount /dev/sdc1
   6 eject /dev/sdc

   1 ### SIMPLE CORRUPTION
   2 zip -F FILE0006.docx -O FILE0006_F.docx
   3 ### FOR HARDER CORRUPTION
   4 zip -F FILE0006.docx -O FILE0006_F.docx

   1 netsh interface tcp set global ecncapability=enabled

   1 C:\Windows\explorer.exe shell:::{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}

   1 c:
   2 cd \windows\system32
   3 copy Utilman.exe Utilman.exe.bak
   4 copy cmd.exe Utilman.exe
   5 copy config\SAM config\SAM.bak
   6 shutdown /r /t 0 -c "Maintenance - Reset password"

   1 net user administrator __new_password

   1 c:
   2 cd \windows\system32
   3 copy Utilman.exe.bak Utilman.exe

   1 

   1