SAM

[np complete]

Is there any way by which we can open SAM files? What happens if some one deletes them ?

[Reverend Jim]

Any chance you can post a sample file?

[JorgeM]

The SAM file is the local Security Accounts Manager File in Windows. There isn't an editor as far as I know, as you can imagine this would be a breach in the sEcurity accounts db. There are tools that can against this file to crack user passwords.

[Reverend Jim]

Oh. I thought you meant SAM as in ISAM (Indexed Sequential Access Method).

[RainbowMatrix]

Three locations of the SAMHashes are:

• %systemroot%system32config

• %systemroot%
  epair (but only if rdisk has been run)

• In the registry under HKEY_LOCAL_MACHINESAM

You can get your hands on this by:

1) Probably the easiest way to do this is to boot your target machine to an
alternate OS like NTFSDOS or Linux and just copy the SAM from the
%systemroot%system32config folder. It's quick, it's easy, and it's effective.
You can get a copy of NTFSDOS from Sysinternals(http://www.sysinternals.com)
The regular version of NTFSDOS is freeware, which is always nice, but only allows
for Read-Only access. This should be fine for what you want to do, however, if
you're the kind of person that just has to have total control and has some money to
burn. NTFSDOS Pro, which is also by Sysinternals has read/write access but it'll
cost you $299.

2) Once again, you may be able to obtain the SAM from %systemroot%
epair if rdisk
has been run and you are lucky enough to have a sloppy admin.

3) You can also get password hashes by using pwdump2. pwdump uses .DLL injection in
order to use the system account to view the password hashes stored in the registry.
It then pulls the hashes from the registry and stores them in a handy little text
file that you can then import into a password cracking utility like l0phtcrack.

4) The final way to obtain password hashes is to listen directly to the network
traffic as it floats by your computer and grab hashes using the above mentioned
l0phtcrack.

[RainbowMatrix]

Hey this seems to be a useful link for ur question http://www.go4expert.com/forums/showthread.php?t=827