Member Avatar for DanielJohns

The disk C was formatted. By means of R-Studio pulled out from it the ntuser.dat and Outlook.pst files. Through regedit I exported from ntuser.dat all branch [HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem] to the .reg the file. I placed in the virtual disk the received file of the register and base with letters. Letters are read without problems, accounts are loaded, but WITHOUT PASSWORDS. In Outlook of a field of passwords empty though keys of POP3 Password are present at the register and are filled with values. Accordingly, when checking mail servers require you to enter a password. Mail PassView too shows passwords the empty.
What to do?

  • 2 Contributors
  • 2 Replies
  • 420 Views
  • 22 Hours Discussion Span
  • Latest Post Latest Post by DanielJohns

Dani AI

Generated

Short summary and what likely happened

Outlook keeps POP/IMAP/SMTP passwords as encrypted blobs that depend on Windows DPAPI (the Data Protection API). Importing a recovered NTUSER.DAT into another install can show the account entries while the actual passwords remain unreadable because the DPAPI master keys and the original logon secret are missing or not usable on the new system. Microsoft documents that CryptUnprotectData (DPAPI) normally requires the same user credentials and, in practice, the same machine to decrypt data. CryptUnprotectData - Microsoft Docs. (learn.microsoft.com)

Practical recovery steps (most → least likely to work)

  • If the recovered volume contains both the user registry hive (ntuser.dat) and the user DPAPI master-key folder (the AppData\Roaming\Microsoft\Protect\<SID> tree) and the original Windows logon password (or its SHA1), the stored Outlook passwords can be decrypted offline. Tools that support “external hive” mode (for example NirSoft’s OutlookAccountsView) accept those three items and will recover the plaintext passwords; the NirSoft page documents the External Disk workflow and notes special handling for Microsoft-account logons (MadPassExt). OutlookAccountsView - NirSoft. (nirsoft.net)

If that data is not available

  • Without the Protect folder and/or the original logon secret, the DPAPI blobs cannot practically be decrypted. Options are (a) restore a full system image that preserves the original user profile and machine state, (b) use the mail provider’s password-reset flow for consumer accounts, or (c) ask the Exchange/mail administrator for a reset for corporate accounts. Always work on copies of recovered files, scan for malware, and avoid repeated live login attempts that could lock accounts. DPAPI and master-key locations and the offline constraints are documented in DPAPI writeups and tooling guides. (insecurity.be)

Context for the thread

’s import of the hive explains why profiles and PSTs appear but passwords are blank. ’s advice to use the provider reset or contact an admin is the correct fallback when the DPAPI/master-key route is not available. The fastest next check is whether the recovered data included the user’s AppData\Roaming\Microsoft\Protect folder and a copy of the original login password; if so, use an external-hive-capable tool as described above.

Recommended Answers

All 2 Replies

Member Avatar for AntonyPope

First you need to specify which mail servers are used: this is the usual free-based Gmail, Hotmail, etc., or corporate email on Exchange?
In the first case to use the password retrieval system on the web services. in the second case - to contact the administrator of corporate mail.
You can still look through the recommendations here
https://answers.yahoo.com/question/index?qid=20140626011359AAG3lF1

Member Avatar for DanielJohns

Thanks for the tip!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.