Computer Hacking Forensic Investigator (CHFI v10) — Question 387

An investigator wants to extract passwords from SAM and System Files. Which tool can the investigator use to obtain a list of users, passwords, and their hashes in this case?

Answer options

• A. Nuix
• B. FileMerlin
• C. PWdump7
• D. HashKey

Correct answer: C

Explanation

PWdump7 is specifically designed to extract password hashes from Windows SAM files, making it the correct choice for this task. The other options, while useful for various forensic purposes, do not have the capability to directly extract passwords and hashes from SAM and System Files.