Видео

Through Win 11 -- in this video this laptop had Win 11 on it. No bitlocker or boot lock though - I haven't tried that yet.

@@JohnathanYerby Thx. Work on all windows version or only a few ?

@@PaulRoger973 all of them for as long as you can boot into the environment, this will most likely work.

I can't recall, but probably somewhere around there.

Medicat is big because it's not just for password resets. It comes with several, and I mean several tools.

NAT is like it was setup behind a networking device running NAT - that device has one IP and uses NAT to give the machines behind it a protected address. It would not be a public address, or even an address on your real Local Area Network -- however - part of what NAT does is allow traffic out to the Internet through that device (hypervisor running NAT) and route it back to the device without exposing the device directly to the public. --- so... no :)

That data is encrypted so no.

@@edwald4056 oh thank u bro ❤️

You can get the Medicat USB here - medicatusb.com/ -- then follow the instructions to make a bootable drive. Once you do that - put the bootable drive in the PC that you are trying to recover and follow what I did in the video above. -- You will need access to another machine to make your flash drive.

It's running a boitable Windows PE image.

@@DrYerby Bro Possible To Rest or delete bitlocker password in Locked Hard Drive like D Drive E Drive from Medicat?

@@Prince.AlBalushi I do not believe so, not with this tool. There are some published reports of breaking bitlocker through sniffing them off of the TPM chip... I've never tried this. www.tomshardware.com/pc-components/cpus/youtuber-breaks-bitlocker-encryption-in-less-than-43-seconds-with-sub-dollar10-raspberry-pi-pico

@@DrYerby oh thank u so much dear ♥️♥️

The TPM approach requires more technical know-how than not knowing Bitlocker encrypts data. 😊 Just saying.

I do not have this setup with me now to test - but my thought is that they both need to be on the same NAT network. It would be like plugging both machines into a switch (with no VLANs or segregating traffic) - once they both have the same network they should be able to communicate.

Just using the arrow keys and the Enter button. You want to get to the .wim which is a Windows Imaging Format - or like booting to an OS disc.

Is this a local or domain password? This is less likely to work on domain passwords - but perhaps there is a local account that you can either enable, create, and set the password. Then take control of the files that you are attempting to access.

@@DrYerby yes, it is probably domain becouse it is a company laptop, I only want to access user account…

@@MaximusDecimusAnonymus I do not believe these will work for that - you can still try to address one of the local accounts -- if it is a domain account and you can get it back on the network, you can just request that the admin reset the password -- if that's not an option - you can try to still use something like Medicat - boot into a WinPE - then access the files that you're needing - copy those out

@@DrYerby Can we add a new user with admin privileges to make backup of our files?

Was it in use when acquired? You have to get it while not locked in use.

If you have the ova or ovf file. You just need that. Once you have that use it like an executable. Open it with your VMware and follow the prompts. It will set up the new vm for you with the OS installed and the vmx file will be there with the configuration - which you can edit to optimize your usage of your hardware.

Thank you@@DrYerby

I was just going back through your comments and the video -- make sure that you have your explorer set to display the file extensions. It may be that it is there but you're not seeing .vmx --- Also - maybe the download or unzip was incomplete - you could re-try those as well.

Supposedly, I had an issue like that cause the VMware Workstation ask me to disable right side effect into the launched Vm file and it was opened aftermath. @@JohnathanYerby

Glad to hear that

You bet!

Yes - CAINE is open source and installable. It's based on Debian and Ubuntu (LTS). It uses the MATE desktop. The process is still the same as it was with version 10.0.

Glad you liked it!

I'm not sure... no plans to do it right now - but I will keep this in mind if I am doing something else interesting in WinHex soon.

Shared VMs or networked VMs? --- Shared docs.vmware.com/en/VMware-Workstation-Pro/15.0/com.vmware.ws.using.doc/GUID-32D21846-E12C-40A4-A02F-E9315B0AE8FE.html --- Network together - ruclips.net/video/7qsTrNuaclI/видео.htmlsi=OtAQMD8D9vZc-93s

Automatic Private IP Addressing (APIPA) is a feature in operating systems (such as Windows) that enables computers to automatically self-configure an IP address and subnet mask when their DHCP server isn't reachable. The IP address range for APIPA is 169.254. 0.1-169.254. 255.254, with the subnet mask of 255.255.

So outdated now. I'd skip it at this point.

oh

If you're using Player specifically I believe it's limited to one VM. You'll want to use workstation pro or the free virtualbox will work.

Update - right now, Broadcom is giving workstation pro and Fusion away for free for personal use.

@@DrYerby Thanks for the info! :)

Make sure that you are using a NTuser.dat file that was not in use when it was acquired. I have not checked this on Windows 11. It may be an issue with the version of the operating system.

That will be slightly different. You'll need to get the iphone file in a format that autopsy can read. There is a newer ingest module - iLEAPP - it's looking for a tar file. You can extract that a couple of ways. - Or if you have access you can use a tool specifically for mobile forensics. - if not, and you want to use Autopsy anyways, just look for more information on iLEAPP.

The VMX file should be opened using your hypervisor, such as VMware Workstation Pro or Fusion for Apple. You can usually get a free 30 day trial of pro, or use VMware player. Then you can open the virtual machine.

@@DrYerby thanks, you helped me fix this issue, have a nice day , you are an awesome human being!