Ways to retrieve a missing persons account passwords

Since the creation of this post, many other ways of retrieving a password has been discovered, e.g. Mimikatz, Lan Turtle & Responder, Konboot and more.

Norwegian newspaper claims police is lacking missing persons social media password

Today, a major newspaper, VG announced that the progress in the of a missing person case may be set back
because they are lacking the persons social media password (Link to article in Norwegian). In this post I will take a closer look into what techniques may be done on the persons machine in order to try retrieve relevant passwords.

Please note that these techniques should only be done in cooperation with law enforcement to prevent damaging potential evidence in a case.

These tips and tricks have already been submitted to the newspaper in a chance to possibly aid the investigation.

6 steps to retrieve passwords and relevant information

Some of the steps are specific for Windows OS. Many of the steps will possibly return the users password which can either be the same or a similar password for e.g. a facebook password. Chances are the person is using the same password several places!

The different techniques is recommended doing while mounting the disk in a different OS while in read-only mode. This can be done by either mounting the drive in another computer or booting the machine with a live CD like Backtrack. The file-system can then be easily accessed without restrictions on permissions or other similar restrictions.

1) The SAM file

As I’ve written about before, the SAM file contains account information on Windows OS. This file can trivially be dumped when physical access to the machine is in hand. The hashes, in some cases weak LANMAN, can then be proceeded to be attacked in order to reveal the clear-text password.

Cain & Abel also have the possibility to dump passwords from machines local system account, often called LSA secrets.

2) Check cookie and temporary internet files

Cookie information on any kind of site which the person has logged into may be able to provide valuable information. In many cases a session ID may be captured and be used to spoof the person. If for example we are able to impersonate the users email session, we may have an excellent chance to use password retrieval functions on sites to either gain a new password for the user, or be emailed back the actual clear-text password.

This site  contains a list over sites that will actually send back your password in clear-text. Sites which contains session information could be washed against the list and be potentially used to retrieve the users password.

Some sites stores session information in hidden fields which in turn could be discovered in temporary internet files.

Even if you cannot retrieve the password in clear-text there is a chance that you may successfully session hijack the persons older sessions and thus potentially revealing relevant information.

3) Recover deleted files

It is not unlikely that deleted files on the machine may contain potentially relevant information to aid the investigation. Deleted cookies, logs or downloaded files are files that would seem interesting for an investigation.

Recouva is an excellent tool for just such a ting, and on top of it all is free without any bullshit that you can only recover a fixed number of files! Very much recommended.

4) Discover logs from chat clients stored locally

Chat clients may very well contain tons of relevant information in regards to an investigation. Applications like MSN Messenger, Yahoo Messenger or IRC usually stores the chat logs on the local file-system.

5) Discover stored passwords in browser or other applications

Very many applications provide some sort of “remember password” logic to provide easier access to resources that is password protected. Most people will recognize this function in our browsers. They provide an option to store the users password in a database and automatically fill inn these when the user navigates to a login form the browser remember.

There is also other applications than just browsers that offer to store passwords for the user. For example many popular games are known to store the users password, or other software like Filezilla has been known to do the same. currently has a list over 47 applications and where they store their passwords. To mention a few:

  • Skype
  • MSN Messenger
  • Windows Live Messenger
  • Microsoft Outlook
  • Heroes of Newerth

Courtesy to Øyvind in the comments for providing me with this link that I previously requested help in finding!

6) Check information from previous breaches

If the person for example had a LinkedIn account the password may very well already be cracked. The blog Security Nirvana say they have cracked over 90% of all the LinkedIn passwords which was disclosed in the hack. Our persons account may very well be one of these 6.5 million accounts and thus we may already have the password ready available.

I am sure there is more…

While this is only the points I came up on top of my head early this morning, when I sent a mail to the newspaper 15 minutes after publication, I am sure there is also several other methods in order to retrieve the persons password.

Hopefully the police investigating these cases make use of techniques like this in their investigations.

If you have any good ideas on other ways to do this process, please leave a comment below or send me an email!

Chris Dale

I'm Chris Dale from Norway, founder and principal consultant at River Security ( Along with my security expertise, I have a background from system development and application management. Having a vast and broad experience in IT certainly help a great deal when working penetration tests and incidents.

I am an open, sharing and engaging person to be around, some even think I'm funny. I am usually enthusiastic and motivating when I work, and usually positive and optimistic about the general problems I encounter. I am passionate about security, both IT and physical security, which is one of the reasons I do a lot of public speaking at different events such as classes, conferences and workshops.

Driven by mottos such as "Magic is just science we don't understand yet" and "Think bad, do good", I attack today's security challenges with eagerness and enthusiasm. I consider myself a pragmatic person, with the ability to think outside the box, keeping the business in focus.

I also teach for SANS. My primary class I am teaching is Hacking Techniques, Exploits & Incident Handling. This course prepares you for the GIAC Certification in Incident Handling (GCIH). I find it extremely motivating and fun to teach others the art of security and hacking, and I often find that my passion and enthusiasm rubs off on my students.

5 thoughts on “Ways to retrieve a missing persons account passwords

  1. Pingback: Current Events

Leave a Reply

Your email address will not be published. Required fields are marked *

Back To Top