Many years ago at school the machines were imaged using Norton Ghost. A floppy disk containing Norton Ghost and it's configuration would be put into the machine, which would automatically start the imaging process.

When these floppy disks inevitably started erroring they'd be tossed into the rubbish bin. I grabbed one of these broken disks, inserted it a few times until my machine would recognise it, and hey presto, the config file along with the domain admin password were now visible.