For the Local SAM and Remote SAM options, you MUST logged in with the administrator rights on the computer you want to dump the SAM. You can either enter the hash manually (Single hash option), import a text file containing hashes you created with pwdump, fgdump or similar third party tools (PWDUMP file option), extract the hashes from the SYSTEM and SAM files (Encrypted SAM option), dump the SAM from the computer ophcrack is running on (Local SAM option) or dump the SAM from a remote computer (Remote SAM option).įor the Encrypted SAM option, the SAM is located under the Windows system32/config directory and can only be accessed for a Windows partition that is NOT running. If you don't exit and restart, the new number of threads will not be taken into account by the program.

If you change this value, you have to exit ophcrack and to restart it in order to save the change. Run ophcrack and set the number of threads under the Preferences tab to the number of cores of the computer running ophcrack plus one.For example, for an old processor set the number of threads to 2, for a Core 2 Duo to 3 and for a Core 2 Quad to 5. This step is optional but will speed up the cracking process. The others ophcrack rainbow tables are sold by Objectif Securite. The XP free small, XP free fast and Vista free rainbow tables are free. Ophcrack rainbow tables are avaible at ophcrack rainbow tables page. Ophcrack and the ophcrack LiveCD are available for free at the ophcrack project page. It also assumes that you understand how to use third party tools like pwdump or fgdump to dump the SAM of a Windows system. This howto assumes you have already installed ophcrack 3 and downloaded the ophcrack rainbow tables you want to use.

Sam file location windows 7