How to Recover VSS Password

A. If you only want to recover admin password in "common" database, which is default database installed by VSS.
1. Creating a new sourcesafe database or install VSS in another box with a new admin password.
2. Copy the um.dat file over the existing um.dat. And you're able to login as admin with the new password.
3. After you login to "common", you can create new database in VSS.

B. Recover others database's password
1. Create a temporary directory, such as C:\SSTEMP.
2. Print the USERS.TXT file, located in the main directory of the SourceSafe server installation. This will give you a list of current users that you can use later to add back into SourceSafe.
3. Use the Admin tool to create a new database in the temporary folder.
4. Run DDCONV . This executable can be found in the server copy of SourceSafe. If you are running Visual SourceSafe 6.0, DDCONV is located in C:\Program Files\Microsoft Visual Studio\Common\VSS\win32. For example: DDCONV C:\SSTEMP
5. Copy the UM.DAT file from the temporary directory to the SourceSafe data directory. Rename or Delete the RIGHTS.DAT and STATUS.DAT files in the SourceSafe data directory.
6. run the Analyze in the Win32 subdirectory with the -F parameter.
7. Finally, with the administrator program, add all the users back into the system, using the USERS.TXT printout that you made in step 2. If you get "Access denied..." or "...directory already exists..." errors, just click the OK key.


Ref:
http://seclists.org/lists/pen-test/2002/Jun/0052.html
http://dotnet.org.za/gangatha/archive/2005/03/17/15617.aspx
http://dotnet.org.za/gangatha/articles/19185.aspx