Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am able to log into my Windows 7 machine as admin and am interested in recovering past passwords for the accounts on my laptop. Is there an easy way to do this, or would it still require cracking the hash with rainbow tables?

share|improve this question

Windows does not store passwords. Only hashes. So whether or not you have any stored past passwords you can not recover them as text from Windows. Only the hash.

share|improve this answer
Pity. Guess it's the hard way then. – Alex Mundy Jun 13 '13 at 4:47

All of your account's passwords stored into a file that called SAM,The Security Accounts Manager (SAM) file in Windows XP, Windows Vista and Windows 7 stores users' passwords in a hashed format (in LM hash and NTLM hash). Since a hash function is one-way, this provides some measure of security for the storage of the passwords.

In an attempt to improve the security of the SAM database against offline software cracking, Microsoft introduced the SYSKEY function in Windows NT 4.0. When SYSKEY is enabled, the on-disk copy of the SAM file is partially encrypted, so that the password hash values for all local accounts stored in the SAM are encrypted with a key (usually also referred to as the "SYSKEY").

In the case of online attacks, it is not possible to simply copy the SAM file to another location. The SAM file cannot be moved or copied while Windows is running, since the Windows kernel obtains and keeps an exclusive filesystem lock on the SAM file, and will not release that lock until the operating system has shut down or a "Blue Screen of Death" exception has been thrown. However, the in-memory copy of the contents of the SAM can be dumped using various techniques (including pwdump), making the password hashes available for offline brute-force attack.

share|improve this answer

protected by slhck Sep 1 '14 at 17:14

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.