Local SAM Dump

If we have access to a windows.old directory or an old Windows backup, we can extract the SYSTEM and SAM registry hives to perform offline credential dumping:

• The SAM hive contains encrypted NTLM password hashes for local user accounts

• The SYSTEM hive holds the boot key required to decrypt them.

impacket-secretsdump -system SYSTEM -sam SAM LOCAL

This technique is conceptually the same as using mimikatz lsadump::sam, which performs the same operation but directly on a live system.