Lately I accidently discovered that a reg save command also exports the transaction log from the registry which allows to restore deleted keys. These can be viewed for example with Registry Explorer.
Using these deleted hives I was able to recover the information of some previously deleted local accounts. I then imported the hive on a trash machine using reg load, imported the exported .reg files from Registry Explorer (as it can only export deleted items as reg files) and did a reg save again. This way impacket was able to export the hashes of the deleted users.
My feature request would be to also parse the transactional log of the dump files and identify deleted users as these hashes might be also useful.
To test this just create a local user, delete it, do a reg save of SAM and check the exported hive with registry explorer.
Example:
Lately I accidently discovered that a
reg savecommand also exports the transaction log from the registry which allows to restore deleted keys. These can be viewed for example with Registry Explorer.Using these deleted hives I was able to recover the information of some previously deleted local accounts. I then imported the hive on a trash machine using
reg load, imported the exported .reg files from Registry Explorer (as it can only export deleted items as reg files) and did areg saveagain. This way impacket was able to export the hashes of the deleted users.My feature request would be to also parse the transactional log of the dump files and identify deleted users as these hashes might be also useful.
To test this just create a local user, delete it, do a
reg saveof SAM and check the exported hive with registry explorer. Example:Links: Reg Format