Which Cain feature helps decrypt SAM and AD password information by decoding SYSKEY?

• A. Hash Calculator
• B. Password Reseter
• C. SYSKEY Decoder
• D. Keylogger

Answer: (C)

Decrypting password information from Windows offline data hinges on SYSKEY, the key that protects the SAM database and related password data. SYSKEY is used to encrypt the SAM data so the hashes aren’t directly readable. The feature called SYSKEY Decoder in Cain & Abel is designed to extract and decode the SYSKEY from the registry, reconstruct the actual system key, and decrypt the SAM (and cached AD-related) password information. Once you can access those encrypted hashes, you can perform offline cracking against them. Other tools mentioned don’t perform this specific SYSKEY decryption: a hash calculator just computes hashes, a password reset tool changes passwords, and a keylogger captures keystrokes.