Posts tagged "hashcat"

An Adventure in Cached Windows Domain Password Recovery

July 11th, 2018 Posted by Uncategorized 0 thoughts on “An Adventure in Cached Windows Domain Password Recovery”

Who in DFIR doesn’t like a good challenge?

 

We had a case recently in which modifications made to a Windows XP Registry, and the impact of those changes on the environment of a particular domain account, were quite important. Digital forensics practitioners on the other side of our case developed their findings on this issue by virtualizing a forensic image obtained from the computer and logging into it with a local account, rather than the domain account in question. Why?

(more…)