---
name: "samdump2"
section: "1"
platform: "linux"
package: "samdump2"
version: "3.0.0-8"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/samdump2"
---

# samdump2(1)

retrieves syskey and extract hashes from Windows 2k/NT/XP/Vista SAM.

## NAME

**samdump2 -** retrieves syskey and extract hashes from Windows 2k/NT/XP/Vista SAM.

## SYNOPSIS

**samdump2** \[*OPTIONS*\] *SYSTEM\_FILE SAM\_FILE*

## DESCRIPTION

- **samdump2** is designed to dump Windows 2k/NT/XP password hashes from a SAM file, using the syskey bootkey from the system hive.

  - **-d**

  enable debugging

- **-h**

  display this help

- **-o** *file*

  write output to file

## EXAMPLE

**samdump2 -o** *out /mnt/ntfs/WINDOWS/system32/config/system /mnt/ntfs/WINDOWS/system32/config/sam*

## AUTHOR

This manual page was written by Adam Cecile \<gandalf@le-vert.net\> for the Debian system (but may be used by others) and modified by Objectif Securite \<info@objectif-securite.ch\> Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL-2.

## SEE ALSO

**[ophcrack(1)](/ophcrack/1.md)**