fortra
Feature Request: secretsdump.py should also parse deleted registry hives
Lately I accidently discovered that a reg save command also exports the transaction log from the registry which allows to restore deleted keys. These can be viewed for example with Registry Explorer.
Using these deleted hives I was able to recover the information of some previously deleted local accounts. I then imported the hive on a trash machine using reg load, imported the exported .reg files from Registry Explorer (as it can only export deleted items as reg files) and did a reg save again. This way impacket was able to export the hashes of the deleted users.
My feature request would be to also parse the transactional log of the dump files and identify deleted users as these hashes might be also useful.
To test this just create a local user, delete it, do a reg save of SAM and check the exported hive with registry explorer.
Example:
Links: Reg Format
