Comments on: Dumping Physical Memory to extract SAM Hashes

By: Peter

Peter — Thu, 23 Jul 2009 06:53:40 +0000

I have read on win32dd author that mdd has severals problems including a cache growing problem which is really a problem during a memory acquisition.

Ref: http://www.msuiche.net/2009/06/08/update-win32dd-12220090608-fixes-improvements/

By: warlock

warlock — Wed, 22 Jul 2009 06:03:06 +0000

Hi Ezekiel, You would have to check if the 2008 box you are using , is utilizing LM Hash, as it is disabled by default, and if its a DC , it will use Kerberos instead..

By: Ezekiel

Ezekiel — Tue, 07 Jul 2009 08:07:07 +0000

Warlock, this is amazing work .. but when I tried this on a Windows2008 server, nothing came back after the hivescan.

By: warlock

warlock — Sat, 21 Mar 2009 13:39:59 +0000

Hi Guys , Thanks for your words ,and keep it tuned , for more stuff..

By: JOOMMaster

JOOMMaster — Sat, 21 Mar 2009 07:46:31 +0000

Ahh !!!!! This is cool ! Thanks for sharing warlock.. I’m gonna try it…….

By: Ade

Ade — Sat, 21 Mar 2009 07:38:01 +0000

This is great stuff , Warlock ! It works flawlessly and I can’t believe it is this easy…