Which Tool Extracts Passwords and Hashes from SAM and SYSTEM Files?

312-49v10 By islever Editorial Last updated

Windows Forensics

Short answer

C PWdump7 parses the Windows SAM and SYSTEM files to list local users and extract their LM/NTLM password hashes.

Question

An investigator wants to extract passwords from SAM and System Files. Which tool can the investigator use to obtain a list of users, passwords, and their hashes in this case?
  1. Nuix
  2. FileMerlin
  3. PWdump7 Correct Answer
  4. HashKey

Key Takeaways

The exam tests whether you can match offline Windows credential extraction from SAM/SYSTEM to the pwdump family, and the trap is picking a hash-cracking or eDiscovery tool with a misleading name.

PWdump7 is the Windows forensic utility used to parse SAM and SYSTEM registry hives and dump local user LM/NTLM password hashes. This page confirms why it is the correct tool for obtaining users, hashes, and password material from those files.

Common mistake: Learners often choose HashKey because its name sounds hash-related, but it is not the recognized utility for parsing SAM and SYSTEM hives and enumerating local accounts.

Expert Analysis

Why the Answer Is Correct

PWdump7 is designed to parse the Windows SAM and SYSTEM registry hives offline, enumerate local user accounts, and dump LM/NTLM password hashes for later cracking. The question's wording — "SAM and System Files", "list of users, passwords, and their hashes" — maps directly to the pwdump family's offline extraction workflow. As jingu_bingo notes, CHFIv11 page 418 associates pwdump7 with extracting LM and NTLM password hashes from the Security Accounts Manager (SAM). aqeel1506 also summarizes the tool's role as obtaining users, passwords, and hashes from those files. SYSTEM provides the boot key needed to decrypt the SAM hashes, so PWdump7's ability to use both files is the decisive detail.

Why the Other Options Are Wrong

Nuix is an eDiscovery and forensic analysis platform for indexing and reviewing data, not a SAM/SYSTEM password hash dumper. FileMerlin is a file-format conversion utility and has no role in Windows credential extraction. HashKey is often confused with hash extraction, and Elb's comment describes a tool that "runs by extracting the binary SAM and system file" then extracts hashes, but that description fits pwdump-style utilities rather than HashKey as the best answer. In the CHFI context, HashKey is not the recognized tool for enumerating SAM users and dumping their LM/NTLM hashes. The vote split does not change the technical mapping: PWdump7 is purpose-built for this exact artifact set.

Community Comment Notes

The thread is split, with most learners selecting PWdump7 and a minority backing HashKey. jingu_bingo's citation of "CHFIv11 page 418" is the strongest study pointer because it ties pwdump7 directly to SAM and NTLM/LM hash extraction. Elb argues for HashKey by describing extraction of the binary SAM and SYSTEM files, but that workflow is still the classic pwdump use case. The comments reflect a typical CHFI distractor trap: choosing a hash-related name over the known SAM/SYSTEM extraction utility.

Exam Strategy

Memorize the pwdump family for offline SAM/SYSTEM hash extraction and associate Nuix with eDiscovery and FileMerlin with file conversion. When a CHFI question names SAM and SYSTEM files together, look for PWdump7 or fgdump rather than a cracking tool.

Frequently Asked Questions

Why are SAM and SYSTEM both needed for password hash extraction?

SAM stores local account password hashes, while SYSTEM contains the boot key needed to decrypt them; PWdump7 uses both to produce usable LM/NTLM hashes.

Why is Nuix not the answer for SAM and SYSTEM password extraction?

Nuix is an eDiscovery and forensic analysis platform for processing and reviewing data, not a dedicated utility for dumping local SAM account hashes.

More 312-49v10 FAQ →

Community Votes

C
67%
D
33%

67% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. aqeel1506 👍 2
    To extract passwords from SAM (Security Account Manager) and System files on a Windows system, an investigator can use the tool PWdump7. This tool is specifically designed for obtaining a list of users, passwords, and their hashes from these files. Therefore, the correct answer is: C. PWdump7
  2. jingu_bingo 👍 2 Answered C
    CHFIv11 page 418. pwdump7 extracts LTM and NTLM pass hashes from Security Accounts Manager (SAM)
  3. Elb 👍 1 Answered D
    This tool runs by extracting the binary SAM and system file from the file system and then extracts the hashes.
  4. Elb 👍 1
    c > PwDump7 extracts LM and NTLM password hashes of local user accounts from the database

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Analyzing Password-Protected Packed Malware

S-grade

Steganalysis for Steganography Attack Detection

S-grade

File Sector Allocation and Fragmentation in Forensics

S-grade

Which Tor Relay Should Investigators Focus On to Trace Data Origin?

S-grade

← Back to 312-49v10 Study Guide