Category Archives: How To

Extracting Facebook passwords from memory image or hibernation file

Passware Kit 12.3 recovers passwords for Facebook, Gmail, and other websites by analyzing a memory image or a system hibernation file. Here is how it’s done. Launch Google Chrome browser on a target machine and open a new Incognito window (Ctrl+Shift+N). In Incognito mode Chrome does not save your passwords, but still they are present in […]

Also posted in Passware | Tagged , , , , , | 3 Responses

Instant extraction of Windows login passwords from Hibernation file or memory image

Windows stores account passwords for all the logged-in users in memory. This holds true for Windows XP through Windows 8. Passwords are encrypted and are not visible in plain text, but there is still a way to identify and decrypt those passwords. When a computer hibernates, Windows writes all the physical RAM memory contents to […]

Also posted in Passware, Tips | Tagged , , | 1 Response

On cracking Mac OS X Lion accounts passwords

Mac OS X Lion stores salted SHA512 hashes of user accounts passwords. NOTE: if a memory image of a target computer is available, Mac OS X login passwords could be recovered instantly. Password hashes are stored in /private/var/db/dslocal/nodes/Default/users/<username>.plist files.

Also posted in Passware, Tips | Tagged , , , | 6 Responses

How effective are your password recovery settings?

Improving password recovery success rates Limited time and resources are usually the two biggest constraints for password recovery. A live memory image could contain encryption keys and passwords, but what are the options if there is no such image available? There are two important metrics for measuring effectiveness of password recovery: success rate and time […]

Also posted in Passware, Tips | 2 Responses