Introduction - If you have any usage issues, please Google them yourself
uarks PwDump is a native Win32 tool to extract credentials Windows operating systems.
It currently extracts :
- Local accounts NT/LM hashes+ history
- Domain accounts NT/LM hashes+ history
- Cached domain password
- Bitlocker recovery information (recovery passwords & key packages)
Supported OS : XP/2003/Vista/7/2008/8
Why another hash dumper?
- No tools can actually dump all kind of hash, a combination of tools is always needed.
- We encounter some rare crash with libesedb library and some NTDS.dit files.
- We think it s safer to directly use Microsoft JET/ESE API for parsing s originally
built with same functions.
- Bitlocker case is added even if some specific Microsoft tools could be used to dump those information.