- taurean25

I plan to use the passware kit. The sam file is not an option because its a domain computer

I'm curious and definitely exposing my lack of knowledge here, because all my work is in an enterprise domain so like you local SAM files don't help - why is the SAM file not an option because it's a domain computer?

Just asking out of ignorance.

Cheers  

If the image is of the domain computer then the domain password is actually stored on the domain controller isn't it? a different computer so you can't recover it that way as it's not stored on the local computer.

My network knowledge is a bit rusty these days so hopefully that's right.  

- Adam10541

a different computer so you can't recover it that way as it's not stored on the local computer.

Again possibly showing my ignorance - why can't we recover it just because it's not stored on the local computer? I'm internal corporate resource, why wouldn't I be able to get my hands on the SAM file (assuming central IT know which file it is, which relates back to an earlier comment of mine I think).

Cheers  

Because, even if you got your hands on the SAM file, it wouldn't contain the domain credentials. SAM stores local accounts only.

If you want domain credentials, that's in the Security hive file within the image. If he's looking for a specific credential, it may not be there. I think it only caches a limited number of domain logins. You guys are constructing Rube-Golberg solutions.

As for using the domain controller, I doubt that another domain computers passwords would be stored there.

I do not know where the domain controller stores passwords for user accounts in the domain. I'd assume active directory, but I am unsure. It does not come up much.  

- taurean25

I have created a virtual machine of a dd image using live view however I need to log into the virtual machine .

The image is from a domain computer

I have tried peter recovery disk but it was unsuccessful

Taurean25,

Liveview makes a Law Enforcement version that allows you to blank user name and passwords when you blow the image into a VM. If you have access to this application i would suggest using it as it will probably prove to be the quickest solution although the other suggestions could also prove successful but would likely require a significant amount of time for the Rainbow tables to break the password. Just an idea.

~N  

LiveView LE version - what about those of us not in LE? It isn't free, but has anyone used VFC2 which claims to be able to bypass Windows password requirements?

Cheers  

Did you try OpenGates ?

www2.opensourceforensi...rg/node/22