Which type of information does a Windows SAM file contain?

The Windows Security Account Manager (SAM) file is a database that stores user accounts and security descriptors for the local computer. For security, it does not store passwords in plaintext or in an encrypted, reversible format. Instead, it stores a one-way cryptographic hash of each local user's password, primarily using the NTLM (NT LAN Manager) hashing algorithm. This ensures that the original password cannot be directly retrieved from the SAM file. The SAM database is exclusively for local accounts; credentials for domain accounts are stored on a domain controller in the NTDS.dit file.

A. The SAM file is specific to the local machine and does not store information for network or domain accounts.

B. The SAM file pertains to local accounts, not network accounts, and uses hashing rather than reversible encryption.

D. Windows uses one-way hashing for password storage in the SAM file, not two-way encryption which would imply a decryption key exists.

1. Solomon, D. A., & Russinovich, M. E. (2012). Windows Internals, Part 1 (6th ed.). Microsoft Press. In Chapter 5, "Security," the section on the "Security Account Manager" explicitly states that the SAM database stores "the user's password as a 16-byte one-way hash value" (p. 289).

2. Microsoft. (2023, April 12). Security Account Manager. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/security-account-manager. This official documentation describes the SAM as a database on local computers that stores user accounts.

3. Al-Azani, S., & Al-Sallami, A. (2017). A Forensic Analysis of Windows Registry. International Journal of Computer Science and Information Security (IJCSIS), 15(1), 315-320. In the section "SAM Hive," the paper states, "The SAM hive contains local users and groups information along with their passwords which are stored in a hashed format" (p. 316, para. 2).