I followed the password recovery instructions in PacketGuide. However, the "touchpwd=" method of password recovery does not work.
There is a 30-second time limit for entering the string touchpwd=. Some configurations may be so large and take such a long time to load on startup that the time limit may be reached before the string can be entered. This problem can be worked around by entering Safe Mode. (Configurations aren't loaded in Safe Mode.)
To recover the password in Safe Mode: