Windows 7 password reset disk internals
In Windows XP era, we know that when a user creates a password reset disk, Windows system will automatically create a public key and private key, and a self-signed certificate. Next, will use the proceeds of the public key of the user account’s password is encrypted, then stored in the registry key KEY_LOCAL_MACHINE \ SECURITY \ Recovery \ <SID>, where the <SID> refers to the user’s SID. The private key is deleted from the computer and stored in the floppy disk.
Windows 7 Ultimate download to the age, we will know the private key file saved in the form userkey.pswfloppy disk or USB flash memory.
But if we try to view the HKEY_LOCAL_MACHINE \ SECURITY \ Recovery registry key, found next is empty, and no user SID.
Then encrypted with the public user passwords, stored in the where in the end it?Obviously, if the light has the private key and public key encryption without a copy ofthe account password can not access user account password.
As the password reset disk to create complete, Lsass.exe process will automaticallyunload the registry hive, so we can not see HKLM \ C80ED86A-0D28-40dc-B379-BB594E14EA1B under the content. But easier to think of is that you can use the following methods to view:
Open a command prompt with administrator privileges to the window, and run the following command to start the Local System as the Registry Editor (Recovery.datneed to use Local System privileges to load):
Psexec-s-i-d regedit
Select the HKLM registry root key, and then click File, Load Hive, and navigate to C: \ Windows \ System32 \ Microsoft \ Protect \ Recovery \ Recovery.dat file.
In the next dialog box, specify a key name in any such can be Test, then expand itemsunder the sub, you can see the current login account’s SID, the right of the default keythat stores the public key used a copy of the encrypted account passwords

Special Price:$129.00

