Which Tool Extracts Passwords and Hashes from SAM and SYSTEM Files?
An investigator wants to extract passwords from SAM and System Files. Which tool can the investigator use to obtain a list of users, passwords, and their hashes in this case?
Community Votes
67% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you can match offline Windows credential extraction from SAM/SYSTEM to the pwdump family, and the trap is picking a hash-cracking or eDiscovery tool with a misleading name.
PWdump7 is the Windows forensic utility used to parse SAM and SYSTEM registry hives and dump local user LM/NTLM password hashes. This page confirms why it is the correct tool for obtaining users, hashes, and password material from those files.
Learners often choose HashKey because its name sounds hash-related, but it is not the recognized utility for parsing SAM and SYSTEM hives and enumerating local accounts.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
PWdump7 is designed to parse the Windows SAM and SYSTEM registry hives offline, enumerate local user accounts, and dump LM/NTLM password hashes for later cracking. The question's wording — "SAM and System Files", "list of users, passwords, and their hashes" — maps directly to the pwdump family's offline extraction workflow. As jingu_bingo notes, CHFIv11 page 418 associates pwdump7 with extracting LM and NTLM password hashes from the Security Accounts Manager (SAM). aqeel1506 also summarizes the tool's role as obtaining users, passwords, and hashes from those files. SYSTEM provides the boot key needed to decrypt the SAM hashes, so PWdump7's ability to use both files is the decisive detail.Why the Other Options Are Wrong
Nuix is an eDiscovery and forensic analysis platform for indexing and reviewing data, not a SAM/SYSTEM password hash dumper. FileMerlin is a file-format conversion utility and has no role in Windows credential extraction. HashKey is often confused with hash extraction, and Elb's comment describes a tool that "runs by extracting the binary SAM and system file" then extracts hashes, but that description fits pwdump-style utilities rather than HashKey as the best answer. In the CHFI context, HashKey is not the recognized tool for enumerating SAM users and dumping their LM/NTLM hashes. The vote split does not change the technical mapping: PWdump7 is purpose-built for this exact artifact set.Community Comment Notes
The thread is split, with most learners selecting PWdump7 and a minority backing HashKey. jingu_bingo's citation of "CHFIv11 page 418" is the strongest study pointer because it ties pwdump7 directly to SAM and NTLM/LM hash extraction. Elb argues for HashKey by describing extraction of the binary SAM and SYSTEM files, but that workflow is still the classic pwdump use case. The comments reflect a typical CHFI distractor trap: choosing a hash-related name over the known SAM/SYSTEM extraction utility.Exam Strategy
Memorize the pwdump family for offline SAM/SYSTEM hash extraction and associate Nuix with eDiscovery and FileMerlin with file conversion. When a CHFI question names SAM and SYSTEM files together, look for PWdump7 or fgdump rather than a cracking tool.
Frequently Asked Questions
Why are SAM and SYSTEM both needed for password hash extraction?
SAM stores local account password hashes, while SYSTEM contains the boot key needed to decrypt them; PWdump7 uses both to produce usable LM/NTLM hashes.
Why is Nuix not the answer for SAM and SYSTEM password extraction?
Nuix is an eDiscovery and forensic analysis platform for processing and reviewing data, not a dedicated utility for dumping local SAM account hashes.