How do I access the Windows NT/2000/XP Password File?

There is no "password file" under Microsoft Windows NT/2000/XP. Microsoft Windows NT/2000/XP stores encrypted password hashes in the Windows Registry.

If you can access the Registry you can use PWDump by Jeremy Allison to view the password data.

PWDump output consists of seven colon delimited fields:

Username

User number

Encrypted password

LAN Man Password Hash

Windows NT Password Hash

Full Name and Description

Home directory

Sample passwd entry: will:1000:30FA7B24C6108C5A8B4BCCA42D5816FF: B3823C82B43238D31BAF98FA4035255F:Will Spencer, FAQ Author::

Broken down, this password entry shows:

Username	will
User number	1000
Encrypted password	5fg63fhD3d5gh
LAN Man Password Hash	30FA7B24C6108C5A8B4BCCA42D5816FF
Windows NT Password Hash	B3823C82B43238D31BAF98FA4035255F
Full Name and Description	Will Spencer, FAQ Author
Home directory

RDISK stores a compressed backup copy of the password hashes in %SystemRoot%\repair\sam._. If you can access this file, you may be able to restore it to another system and access the password information contained within it.