When Windows Syskey is used, what does the hashdump script attempt to recover from the Registry?

• A. Password Hashes from Memory
• B. Syskey from the Registry
• C. Master Boot Record
• D. Network Route

Answer: (B)

When Syskey is enabled, the Security Accounts Manager (SAM) database is encrypted with a Syskey that is stored in the registry. The hashdump tool’s job in this scenario is to locate and extract that Syskey from the Registry so it can decrypt the SAM and access the password hashes (NTLM/LM) contained within. Without recovering the Syskey from the registry, the SAM remains encrypted and its hashes cannot be dumped. The other options don’t describe what hashdump retrieves in this Syskey-protected context.