Tag Archives: how to

Extracting Facebook passwords from memory image or hibernation file

Passware Kit 12.3 recovers passwords for Facebook, Gmail, and other websites by analyzing a memory image or a system hibernation file. Here is how it’s done. Launch Google Chrome browser on a target machine and open a new Incognito window (Ctrl+Shift+N). In Incognito mode Chrome does not save your passwords, but still they are present in […]

Posted in How To, Passware | Also tagged , , , , | 3 Responses

Instant extraction of Windows login passwords from Hibernation file or memory image

Windows stores account passwords for all the logged-in users in memory. This holds true for Windows XP through Windows 8. Passwords are encrypted and are not visible in plain text, but there is still a way to identify and decrypt those passwords. When a computer hibernates, Windows writes all the physical RAM memory contents to […]

Posted in How To, Passware, Tips | Also tagged , | 1 Response

On cracking Mac OS X Lion accounts passwords

Mac OS X Lion stores salted SHA512 hashes of user accounts passwords. NOTE: if a memory image of a target computer is available, Mac OS X login passwords could be recovered instantly. Password hashes are stored in /private/var/db/dslocal/nodes/Default/users/<username>.plist files.

Posted in How To, Passware, Tips | Also tagged , , | 6 Responses