312-49V11: Computer Hacking Forensic InvestigatorDemo

By ECCouncil · Question Mode

QuestionQ277

Tools/Systems/Programs

An investigator needs to extract passwords from the SAM and System files. Which tool can the investigator use in this situation to obtain a list of users, passwords, and their hashes?

  • A Nuix
  • B FileMerlin
  • C PWdump7
  • D HashKey
Explanation

PWdump7 can directly dump the SAM and SYSTEM registry hives, retrieve the SYSKEY material from the SYSTEM hive, and decrypt and output local users’ LAN Manager (LM) and NTLM password hashes. Windows stores local account password hashes in the Security Account Manager (SAM) database.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!