# Registry and Credential Extraction from Memory

> Extract Windows credentials from RAM. Learn to dump NTLM hashes, LSA secrets, DPAPI keys, and registry hives directly from memory using Volatility.

Canonical: https://codelivly.com/rooms/registry-and-credential-extraction-from-memory
Last updated: 2026-09-13

| | |
|---|---|
| Level | Advanced |
| Category | Forensics |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 100 |

This advanced module focuses on extracting sensitive authentication data directly from volatile memory. You will learn to recover NTLM password hashes, plaintext credentials, LSA secrets, cached domain logons, and DPAPI master keys by parsing the SAM, SYSTEM, and SECURITY registry hives in RAM. Using Volatility plugins like hashdump, lsadump, and lsascan, you will uncover how attackers (and defenders) extract credentials without touching the disk, bypassing endpoint detection and recovering access to encrypted data. Mastering these techniques is critical for understanding credential theft, lateral movement, and post-exploitation forensics.

## Lessons

1. What Can Be Recovered from Memory and Why It Matters (30 min)
2. In-Memory Registry Artifacts (30 min)
3. Extracting Credentials from Memory (30 min)
4. Guided Lab: Full Memory Analysis Investigation (30 min)

## Related

- [Learning path: Memory Forensics](https://codelivly.com/learning-paths/memory-forensics)
- [All rooms](https://codelivly.com/rooms)