drop sam hive · local accounts · login metadata · password hints · no hash extraction · csv export · runs locally
SAM hive
drop SAM hive file
or click
extract from C:\Windows\System32\config\SAM — forensic metadata only, no NTLM hashes
drop SAM registry hive (binary)