AIX 2.1 root passwords (IBM RT)

Well our IBM RT / 5085 / CATIA setup all checks out and the hard disks seem good - it'll boot to a login prompt on the MDA console (and issue a message about the 5085 interconnect being happy) Unfortunately we have no idea what the root password is :-( Tried the obvious guesses. Are there any kind of tricks in order to reset / break the root password under AIX 2.1? We seem to have a reasonable complement of AIX floppies - perhaps there's a way in there? Or maybe an insecure account which can be used to snarf the passwd file (did AIX use shadow passwords)? Or maybe a way of dropping to single user on the console without a login password? etc. etc. Sadly the hard disks are ESDI - if they were SCSI it'd be trivial to stick them in a different machine and start hacking at the disk block level. Last resort I suppose is to install a copy of the OS on another drive, then attach the current OS drive as a secondary, mount the relevant partition, and edit the 'current' password file. That's a lot of effort though, and I'm not sure what we have in the way of spare ESDI drives anyway. (I don't think we have full install media for additional things like CATIA, so reinstalling the OS over the top of the current data is something we'd like to avoid) cheers Jules