I am trying to recover login information of another computer. I have managed to copy the local/roaming profile credential files located in C:\users\%username%\APPDATA\local\Microsoft\Credentials\ and C:\users\%username%\APPDATA\roaming\Microsoft\Credentials\

when I try to copy these credential files in my credential store location, the files are automatically deleted. no clue why? I am trying to recover logon credentials from these files I found on my other computer. I am looking for an elegant way and I dont know the logon password, and I rather not use any cracking methods.

  • Can you share the OS details and other relevant details ? What type of credentials ? – Ashutosh Raina May 8 '19 at 16:38
  • 1.What credentials are you looking for.? 2. Read this link docs.microsoft.com/en-us/windows/win32/api/dpapi/…. Usually softwares which stores passwords in this directory use the API CryptProtectData (with revelant flags) so that decryption of credentials is only possible on the computer where the data was encrypted. – Ashutosh Raina Jan 14 '20 at 19:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.