1. Computing
Tim Fisher

Use Ophcrack LiveCD to Recover Passwords

By June 12, 2008

Follow me on:

Lost your user account password in Windows? It only seems to happen when you have a ton of work to do and you've procrastinated until the last minute. Lost your administrator password? You'll need that password to access diagnostic tools to fix major system problems. It's really frustrating trying to guess a password you've probably never used while troubleshooting a dying computer.

Do not fear! Ophcrack is here! Ophcrack is a free (yes, you read that correctly) program that can recover just about any lost password. The LiveCD version of Ophcrack fits on a CD and does a very good job at "cracking" or "hacking" your lost password.

I've put together a step-by-step guide to using Ophcrack LiveCD to recover your password, complete with screenshots and help burning the CD, booting to the CD, etc. Using this guide, you should be able to hack your own password with Ophcrack LiveCD even if you've never tried anything like this before. It's that easy.

I also have a full review of Ophcrack that discusses some of the important features of the program.

Edit (July 31, 2010) : If you're having problems using Ophcrack, try the following:

  1. Read the "step by step guide" linked above if you haven't already.
  2. Read the comments below.
  3. Leave a comment below or in my forum asking for help.
  4. Try Offline NT Password & Registry Editor, PC Login Now, or Kon-Boot, three other programs that work completely differently and so might work if Ophcrack doesn't agree with your PC.
  5. ... or if you're hell-bent to get Ophcrack to work, try asking for help on the official Ophcrack forums.
Connect With Tim: Google+ | Twitter | Facebook
Comments
June 18, 2008 at 2:40 am
(1) John says:

Dear Tim,
Hi, I have been able to successfully download the ophcrack live cd iso thing to a cd, and kind of boot my pc from the cd. But as I boot it from the cd I get as far as up to here- http://pcsupport.about.com/od/toolsofthetrade/ss/ophcracksbs_6.htm on the screen. That image does actually come up, and it does count down like you say, but then after that my screen goes blank and theres nothing on my screen? And then as my screen is blank(black), my screen actually says-”Input range out of range, switching to”…some other number like 60hz or something like that. And I’m pretty sure my cd drive was still working cause the green light on it was flashing, and it was making that verrrrm noise. I waited about 15 min and still nothing happened? Why isnt anything appearing? Is it just the screen, or is the cd messed up, although I dont think its the cd because that picture(in the link) with the countdown comes up. Do you know?
Thanks, John

June 19, 2008 at 2:48 pm
(2) Tim Fisher says:

John,

Other readers have complained of this same issue but I haven’t replicated it myself on any system I’ve used ophcrack LiveCD on.

My suggestion would be to post this question in the support forums on ophcrack’s website. Someone from the development team might be able to help you out there.

June 30, 2008 at 8:49 pm
(3) Marshall says:

I’ve tried for 2 days to get this to work. It doesn’t. How could this program possibly be ‘the best’? I think it’s a scam.

June 30, 2008 at 9:31 pm
(4) Tim Fisher says:

Marshall,

In my experience with several password cracking tools, Ophcrack is by far the quickest, easiest, and most effective tool. However, like every other program on Earth, it’s not perfect. Some people have problems with it.

I’m also not sure how it can be much of a “scam” when it’s free, but if you don’t like it, don’t use it.

My suggestion would be to visit Ophcrack’s support area and see if there’s a fix for your issue. If it’s just not finding your password then it may be too long or complicated for Ophcrack to find. Again, check Ophcrack’s support site for more help there.

Hope you have better luck in the future!

July 27, 2008 at 5:25 pm
(5) Robert Moore says:

Some time ago I password protected the BIOS on my computer and lost the password. I tried using Ophcrack, but it only finds account passwords. Is there any thing I can do to remedy this?
My computer is a Lenovo laptop 3000 C200
Windows XP Home 1.5 GB Ram

July 28, 2008 at 8:44 pm
(6) Tim Fisher says:

Robert,

I’d check the manual that came with your laptop or check with Lenovo’s website. Usually there’s a way to reset the BIOS configuration on the motherboard. Since you’re using a laptop, this may be a little more difficult or maybe even impossible but Lenovo will have to give you more details.

If you had a desktop I might be able to give you some general guidance but laptops can be very different.

August 7, 2008 at 4:18 am
(7) Gavin V says:

Hi Tim, Ophcrack will not boot on my laptop. The issue i am having with Ophcrack is that once i boot the Lap and it begins its initial startup i recieve an Error message saying something like ” Linux Error 47A etc..
This happens also on my desktop Pc, could it be due to the burning process?

August 7, 2008 at 4:30 pm
(8) Tim Fisher says:

Gavin,

My guess is yes, it’s the burning process. Something must have “goofed”. I haven’t ever seen that error in my uses of Ophcrack so the fact that you’ve seen it on both seems a bit odd.

Then again I’m not an Ophcrack expert either. You could try the forums on the Ophcrack site… they might give you some idea if a re-burn doesn’t do the trick.

September 14, 2008 at 12:14 pm
(9) boss007 says:

guys if i have download the ophcrack password cracker but i think though it is easy and quicker process it is not strong enough to crack ur strong password.if u give ur password
text+digit then it only able to find it out.Example: password is “tasnim004″ but if u make a strong password like “tas@%!001″
it this case it will not able to find out the password
i tested it many times with many password

September 15, 2008 at 5:29 pm
(10) Tim Fisher says:

Yep – the best way to prevent someone from using a tool like this to crack YOUR password, use a strong password with lots of numbers and characters.

October 5, 2008 at 10:48 pm
(11) Tim Kelly says:

I run the program but it never finds the user. What do i do?

October 22, 2008 at 11:41 am
(12) Tim Fisher says:

@Tim – If a user is never found, then it doesn’t exist where Ophcrack is looking, it does exist and Ophcrack is having an issue of some kind, or your Windows installation is having issues other than your inability to remember the password.

If I were you, my next step would be to visit the Ophcrack forum and ask for help. That, or use another password cracking program like PC Login Now:

http://pcsupport.about.com/od/toolsofthetrade/gr/pcloginnow.htm

December 21, 2008 at 10:47 pm
(13) ophcrack lover says:

Tim, I want to thank you for your work here! Many, many thanks!

You might want to emphasize the importance of the BIOS boot list though.

Also, on the computer I needed to open, there were two partitions, named 0 and 1.

ophcrack ddn’t work on 0 but worked wonderfully on 1.

Any advice on opening 0?

December 24, 2008 at 9:57 am
(14) Tim Fisher says:

ophcrack lover – I’ll be sure to update the guide and stress that point.

Do you have a valid Windows installation on partition 0? If not, there would be no password to retrieve.

January 3, 2009 at 9:51 pm
(15) Matt says:

Well, I’m in the camp that can’t get this program to work. The Linux OS doesn’t finish the boot, ends up with some I/O error and sits forever. Reburned the disk, same thing.

This is the error I’m getting, looks like I’m not the only one:
http://ophcrack.sourceforge.net/forum/viewtopic.php?f=14&t=326

With exactly the kind of help you’d expect from an open source solution.

If it works, great, if it doesn’t, look elsewhere.

January 4, 2009 at 10:03 am
(16) Tim Fisher says:

Matt, you have a good point. When it comes to support, open source software can be hit-and-miss.

January 26, 2009 at 10:26 pm
(17) Shon says:

I really appreciate what you are doing here and I am hoping that you can be of assistance to me. I have downloaded the version for Vista and that went fine. I have burnt the ISO file to a disc using Roxio and a ISO burning software and both processes worked very well. I have restarted my laptop with the disc in and it all goes according to plan and comes up to the screen that you show in part 6 of you step by step. Now here is where my problems starts. Like you mentioned in part 7 a lot of lines of text start streaming down the screen but it never gets through it all??!!! Your part 7 shows a line stating something about the website followed by some lines of text under that with green * in front of them and I never get to that point. It always hangs up just after something that has to do with SOMETHING similar to this “asxi=-0, pin=-1, asxi=-1, pin=-2″ (that is not the exact letters but similiar) and under that is just a blinking cursor. I wait, and wait and nothing and the computer shuts down???? I don’t know what else to do. HELP

January 27, 2009 at 4:46 pm
(18) pacman says:

i downloaded it and it all went to plan and burned it and it all worked however wen i reboot it it gets stuk on one screen which is screen 8. it dosnt go onto screen 9 but it shows it found 2 participants with hash and it has number 0 nxt to the first one and 1 next to the second one but nothing hapens afterwards.. plz help

January 27, 2009 at 7:32 pm
(19) Tim Fisher says:

To everyone having problems with Ophcrack – I’d recommend visiting their support area at http://ophcrack.sourceforge.net/forum.

If you just flat can’t get it to work, check out another password cracker. PC Login Now is good and is in the list:

http://pcsupport.about.com/od/toolsofthetrade/tp/passrecovery.htm

January 29, 2009 at 9:58 am
(20) paxman says:

i pressed enter on that screen and it sasy problem with finiding hash and all that and it dosnt crack passwords it just ask me to shut down the system wt do i do

February 21, 2009 at 11:46 am
(21) Ray says:

Hello Tim:

I downloaded the iso image, and copy to CD. When booting the computer with the CD, it gives me the following error:


Could not find kernel image: linux
boot:

What should I do at this point?

Ray

February 21, 2009 at 12:22 pm
(22) Tim Fisher says:

Ray – check out comment #19 above.

February 24, 2009 at 4:51 pm
(23) Andrew says:

hi tim
yeh um i downloaded ophcrack (latest version)
i tried it on my computer andit works however i tried it on my laptop and it gets stuck on something called multiuser wat do i do know thanks

February 24, 2009 at 7:10 pm
(24) Tim Fisher says:

Andrew, your laptop is either having some kind of problem (either with the hard drive or the CD/DVD drive) or Linux (which is the OS loading from the CD you made) is having an issue working with that particular set of hardware.

I’d recommend visiting Ophcrack’s support site.

March 26, 2009 at 4:47 pm
(25) Kevin says:

help? When I get to the launch.sh window (http://pcsupport.about.com/od/toolsofthetrade/ss/ophcracksbs_8.htm), it shows three partitions and prompts me to choose one. When I choose any of them, it displays “Starting Ophcrack”, bu then says there was an error in the file. What’s going on, and how can I fix it?

March 28, 2009 at 3:00 pm
(26) Tim Fisher says:

Kevin: You might have a serious problem with your hard drive and those partitions aren’t accessible to Ophcrack.

Other than that, it might just be a problem with Ophcrack. Have you tried their forums?

March 28, 2009 at 10:14 pm
(27) Justin says:

I used the graphic mode but how come I cant read any of the text in the window that opens?

March 28, 2009 at 10:23 pm
(28) Justin says:

And to add to that the first window that shows says “Problem while preloading table vista free,2 at file 1. Input/output error” like 6 times

March 29, 2009 at 12:30 pm
(29) yep says:

I’ve used Ophcrack before on my newer laptop and it worked just fine. However, I am trying to use it on my other older laptop (about 5 yrs old, xp, bios 8) and my old login does NOT show up in the list of usernames). Care to share where I can look for a solution? thanx.

May 4, 2009 at 8:54 am
(30) Munee says:

Hi
I used it as you said but at the end password not found what shoul i do?

thanks

May 4, 2009 at 9:13 am
(31) Tim Fisher says:

Hi Munee,

Have you tried the second program in the list of tools, Offline NT Password & Registry Editor?

http://pcsupport.about.com/od/toolsofthetrade/tp/passrecovery.htm

It works differently so you should give it a try.

May 21, 2009 at 6:02 pm
(32) Tyler says:

I have fully downloaded Ophcrack LiveCD, when i boot with it then I reach the graphical interface, but ophcrack does not start automatically. how do i get Ophcrack to start cracking.

Thanks.

May 22, 2009 at 7:09 am
(33) Tim Fisher says:

Tyler: It should start automatically so if you don’t see a window or other dialog box that’s asking/telling you something, them Ophcrack is probably failing on you to some degree.

Have you tried their forums that I’ve linked to a few times in other comments? How about the other password tool I linked to in my comment above yours?

June 3, 2009 at 10:37 am
(34) Jordan says:

Hi, I was wondering if you could help me out with what I believe to be a simple problem with the Ophcrack Software. Using your tutorial, I’ve been able to successfully run Ophcrack and begin cracking the passwords.However..it doesn’t seem to be working correctly. I first tried to recover the password using the text-only method,and it seemed to work fine. The name of the profile I need to crack is named “Sherry,” and it said it found the password for this profile. It displayed that the NT password for Sherry is “…….” which Is not correct. When I tried running it on the normal Graphic version, it displays the profiles but it’s almost as if the font is white against the white background..the information appears to be invisible even though I know the cracking is complete and it’s displaying the password. Is there any way to make the text visable?

Please contact me at this email, anyone who knows how to fix THIS;

jordan_jaml13@hotmail.com

June 4, 2009 at 7:52 am
(35) Tim Fisher says:

Hi Jordan – I saw your post in the forum and I’ll respond there:

http://forums.about.com/n/pfx/forum.aspx?tsn=1&nav=messages&webtag=ab-pcsupport&tid=6862

June 4, 2009 at 2:20 pm
(36) april angello says:

i have the same question as #18 but your reply link on #19 doesn’t follow through. i still can’t find anything to help me out and i’ve tried finding other sites. i don’t know what to imput and highlighting/entering just ends up with and error reading file message…

June 4, 2009 at 2:26 pm
(37) Tim Fisher says:

April,

The Ophcrack forum changed their location. Try this:

http://apps.sourceforge.net/phpbb/ophcrack/

Also, PC Login Now is now a pay-for program. A free equivalent can be found here:

http://pcsupport.about.com/od/toolsofthetrade/gr/offlinentpwed.htm

Hope that helps.

August 13, 2009 at 4:10 pm
(38) saf says:

Hi Tim,
First of all thanks for your step by step process it was very clear and handy. Only problem is when i let the ophcrack run, it follows through to the point where it gives me a hash thing, then says my password is saved in /tmp/ophcrack.txt
I went online and searched for a solution, only one i could find said i should type “n” for it not to shutdown, then to type “more /tmp/ophcrack.txt” but it still did not work. Going to the website like you said in your #19 comment didn’t help either. Any suggestions? Thanks a bunch.

August 16, 2009 at 9:35 am
(39) Tim Fisher says:

saf: Are you using the Live CD version of Ophcrack or the desktop one?

August 15, 2009 at 10:28 pm
(40) Alison says:

Hi Tim,

I’ve run Ophcrack, and unfortunately my password is a strong one, so Ophcrack hasn’t been able to find it. However, I know my password–well, almost. It’s a word with numeric and other character substitutions–the EXACT nature of which I can’t quite remember, or I wouldn’t be having this problem. Is there any way to prompt Ophcrack with what you think the password is and have it start from there? So for instance if you think the password is something like “p@$$w0rd”, but you haven’t quite got it right, Ophcrack could start with a partial solution and perhaps be successful from there? If Ophcrack can’t do this, is there another program that can? Thanks much.

August 16, 2009 at 9:38 am
(41) Tim Fisher says:

Alison: No, Ophcrack does not have this functionality. It would be very cool if it did, but it does not. I’m not aware of another program, free or not, that does that. My suggestion to you is to use another program like ONTPRE (it’s free too). It deletes the password, it doesn’t find it. It’s a great alternative unless you have your files encrypted, in which case you’d lose access to them forever… unless you remembered your password sometime in the future. Most people haven’t encrypted their files.

August 25, 2009 at 3:27 pm
(42) Sam says:

Hi Tim: I’ve been trying to put ophcrack on my SanDisk Cruzer Micro 4GB and previously gotten error such at “Disk error” or “Kernel image not found: Linux” but after messing with it I got rid of the errors when i started over and followed this guide http://techrena.blogspot.com/2009/03/ophcrack-usb-booting-windows-password.html

however now when i select it to boot from the usb it gives me a blank (white) screen and when i hit enter it prompts me for a password. Can you help?

August 31, 2009 at 12:01 pm
(43) Tim Fisher says:

Sam, I haven’t tried booting to Ophcrack via USB but my guess is that your USB drive wasn’t formatted properly. Did you use a tool like the HP USB Format Tool to do the formatting?: http://www.pcworld.com/downloads/file/fid,64963-order,4/description.html

August 30, 2009 at 4:14 am
(44) jc says:

i used ophcrack it went trough the hall prosses and at the end it said no found.

anyone knows why ? and what should i do?

August 31, 2009 at 12:05 pm
(45) Tim Fisher says:

jc, take a look at some of the previous comments. My suggestion would be to visit Ophcrack’s forum or try another password tool. There may be an issue with your installation of Windows that’s preventing Ophcrack from seeing it.

September 2, 2009 at 12:37 pm
(46) Joshua B says:

Hey Tim. I was wondering how to get ophcrack to work using the desktop version? whenever i try i cant find the hash files. When i try to find the encrypted SAM where it says it usally is (C:\WINDOWS\system32\config\) it says no valid hash file found???

September 4, 2009 at 7:31 am
(47) Tim Fisher says:

Joshua, I’ve never used the desktop version. I’ve been under the assumption that it works similarly so I’d treat the error similarly. I’ve heard of this one on the LiveCD version and it usually means that there’s some issue with your Windows installation or SAM or Ophcrack simply won’t work with your installation for some reason. Why this happens I don’t know. Have you tried posting in the Ophcrack Forums for an answer? I’m sure a developer would have a better answer than me! http://sourceforge.net/apps/phpbb/ophcrack/

October 14, 2009 at 3:01 pm
(48) KC says:

A couple of minor hiccups but totally worked! Thanks!

October 16, 2009 at 4:55 am
(49) X35 says:

when i reboot my system on ophcrack live cd then after every thing it linux appears.then how to crack the password ???

October 19, 2009 at 8:59 am
(50) Tim Fisher says:

X35, everything should be automatic. When Ophcrack boots, a long procedure starts that finishes with the display of your passwords. You usually don’t even have to hit one key.

You can see the whole walk-through here: http://pcsupport.about.com/od/toolsofthetrade/ss/ophcracksbs.htm

October 20, 2009 at 3:27 pm
(51) Thor says:

I downloaded the live cd for vista because my laptop is running windows 7 but when I go to boot it, it just goes to a blank grey screen. Can anybody help me? Thanks

October 21, 2009 at 9:49 am
(52) Tim Fisher says:

Thor, do you get any indication that the CD is being booted to at all? Any logo, message, etc.? If not, it may be that the CD was not burned properly, the download was corrupted, or your computer is not properly booting the drive. You can check BIOS to be sure of that.

October 23, 2009 at 2:45 pm
(53) chuck says:

OK, going after vista home premium on a Acer Aspire AM1610-U1201A. iso burned, 3.31 loaded no problem, running slitaz, all looks good. The auto launch can find no hash files. I go to mount the drives manually, and only the recovery partition is available, sda3. I’m certain that the SAM file is on sda2. My suspicion is that Vista is protecting even viewing the drive from a virtual system. Do I need to find and load a device driver list in order to view the sda2?

What else could be going on.

Thanks in advance.

Chuck

October 25, 2009 at 9:26 am
(54) Tim Fisher says:

Chuck, if you need to install a driver for Ophcrack to veiw that partition then you’re over my head on the program. You might get some help from the Ophcrack folks over on their forum: http://sourceforge.net/apps/phpbb/ophcrack/

Be sure to try ONTP&RE too:

http://pcsupport.about.com/od/toolsofthetrade/gr/offlinentpwed.htm

November 12, 2009 at 4:25 am
(55) DeeZee says:

ophcrack – could not find kernel image linux error. used usboph. followed every step correctly. How do you fix the error? I checked comment #19. That forum does nothing. I loads a blank page. Please explain how to fix the error. Feel free to email me any links that would help me or detailed steps to take to fix this error. Thank you.

November 16, 2009 at 4:32 pm
(56) Tim Fisher says:

DeeZee, try the link in Comment #54. They’ve moved to a new forum since #19 was published.

December 19, 2009 at 11:48 am
(57) Spock says:

There is the possibility that all glitches in ophcrack are caused by antivirus programs, which may remove important files while downloading, making it unusable

December 24, 2009 at 9:35 am
(58) Tim Fisher says:

@Spock: I agree, especially with issues where Ophcrack doesn’t seem to work at all, that the problems could be caused from antivirus programs interfering with the original ISO download. I’d be surprised if it had anything to do with “problems” like “No Password Found” after a search but as far as it not starting or running properly, I tend to agree.

December 19, 2009 at 5:04 pm
(59) Xragoon says:

hey, i downloaded the ophcrack live cd for Vista, and the download seens to not exceed the download it was suppose to. For ex> vista live cd is suppose to be 520 mb, but when i download it,it turns out to be always 496 mb. O yea and also, when i burn the iso. file to the DvD, it turn out to be Ophcrack on Slitaz not Ophcrack Linux . Did i do something wrong or was it something else? Thanks

December 24, 2009 at 9:37 am
(60) Tim Fisher says:

@Xragoon: My information is probably outdated… if you download it from here then I’m sure you’re fine.

December 22, 2009 at 9:14 am
(61) Mike 199 says:

Hi, I succesflly installed the ophcrack nd rebooted the system, it worked to the point where it was finding passwords.
The thing is it found a few standard user passwords but for the admin password it said ‘not found’.
What should i do?

December 24, 2009 at 9:39 am
(62) Tim Fisher says:

@Mike 199: The password may be too long/complex or there may be some other problem. Try Offline NT Password & Registry Editor instead.

December 22, 2009 at 1:44 pm
(63) Max says:

i downloaded ophcrack livecd for vista, and burned it onto the cd. the booting was successful, and the maini menu image appeared and the the thing did count down. however, when i chose any option, a bunch of lines appeared, ending with
–[end trace 4eaa 2a86 a8e2 da22]–
and it just hangs there. what is the problem?

December 24, 2009 at 9:40 am
(64) Tim Fisher says:

@Max: Try downloading and burning the ISO again. That’s certainly not normal. You can always ask more questions on the Ophcrack forums or you can try another free windows password recovery program like ONTP&RE.

December 24, 2009 at 6:47 pm
(65) Xragoon says:

Hellow again, sorry but I am still recieving the same issues that occured in my last question. Just to verify, the iso. file that i downloaded when i checked was 496 mb/508154kb and titled Ophcrack on Slitaz. Can you verify that when anybody downloads the file, that I have the same file for sure? Also, when i booted the cd, im suppose to boot from cd right, because in my settings, there was also an option for booting from desktop.

December 28, 2009 at 7:47 am
(66) Tim Fisher says:

@Xragoon: Yes, you should be booting from the CD you burned.

Yes, there is a way to verify the file. First, make sure you’re downloading from here: http://ophcrack.sourceforge.net/download.php?type=livecd

See those md5sum numbers? You can check the MD5 hash on the download and make sure it matches with these numbers. There’s a recent post on my forum that explains this a bit more: http://forums.about.com/n/pfx/forum.aspx?tsn=1&nav=messages&webtag=ab-pcsupport&tid=8011

December 25, 2009 at 6:30 pm
(67) Xragoon says:

In last comment not boot from desktop- boot from hardrive*

December 28, 2009 at 1:58 pm
(68) Xragoon says:

94da94d4802d7559e43103580e0c2eb8 postdict
5985a81aff9b84d41a1f77eb0e2f91aa stats
06b27a6e97fee09f3d5d3dd8b9ff33b2 table0.bin
444986b4be87121ae54c22eaea39200b table0.index
886984c648d9c1d3875b19ef851f40ed table0.start
172bf0fe8cf4ea11eb3151b34a8e9676 table1.bin
b26e179ebef71f583c37737af7caf616 table1.index
394b1a73765e45798a596b78297141e9 table1.start
75387a36893747429cb392d40c9876e3 table2.bin
72b070dec2cd6cfb12202b50518dd2b7 table2.index
a5fd3e286520d42096a019e3007e7b1a table2.start
c0b7127f9c2f7fd5ef892896b163cd1b table3.bin
801a688e56ce32b4b87cfb504c3c11b7 table3.index
de95f027c1092dc9cf9c98a2b3049201 table3.start
a7a848d921a3c576d780d567182a7431 worddict

Thats md55sum # i got ????

December 28, 2009 at 4:53 pm
(69) Tim Fisher says:

@Xragoon: There’s no reference point for the hash on the files inside the ISO. The only hash you care about (since it’s the one listed on the download page) is the hash for the ISO file itself.

December 29, 2009 at 4:16 pm
(70) Aidan McGoff says:

Hey, i’m using Windows Vista Home Basic from Acer. It won’t even load up! I Burnt it to a CD using BurnExpress and Nero. I got to the part where it says Load from CD, I click that another thing called, HL-DT-ST DVDRAM GSA-H4. Then it just goes back to the way it would normally boot up. Please help!

January 4, 2010 at 9:52 am
(71) Tim Fisher says:

@Aidan: After burning the ISO to the CD, did you reboot your computer? I just want to make sure we’re on the same page as we troubleshoot this.

December 30, 2009 at 1:04 am
(72) Ahmed says:

Hi
I run the ophrack live cd but it is not finding the password for admin user. can u help me out.

January 4, 2010 at 9:54 am
(73) Tim Fisher says:

@Ahmed: If Ophcrack seems to be working properly but didn’t find the password, then it didn’t find the password. Ophcrack won’t find overly complex or long passwords (in other words – it won’t find a really good password). Try ONTP&RE, linked to in several other comments in this post.

December 30, 2009 at 7:17 pm
(74) Jairo says:

Hey
I just burnt ophcrack LiveCD, i know how to burn a .ISO file, so i think that isn’t the problem.
I put it in the computer that i want to recover and i make it boot from CD.
appears that message that says “Boot from CD:_” and after a few seconds the screen goes black and starts up with windows XP… What’s the matter? can u help me please?

December 31, 2009 at 12:38 am
(75) nikki says:

When i try to burn the iso file to the cd it says table of contents not found and then burn failure. is there something i am doing wrong?

January 4, 2010 at 9:55 am
(76) Tim Fisher says:

@nikki: This is happening during the burn process itself? What burning program are you using?

January 6, 2010 at 6:13 pm
(77) Xragoon says:

I found out that my download was correct because i read your new guide. In the guide, i got up to Step 6 but I was not able to continue. I end up in a desktop and the partiotion screen but there is no activity. What happened?

January 12, 2010 at 11:49 am
(78) Tim Fisher says:

@Xragoon: I don’t think Ophcrack and your computer get along :) . Have you tried anything else, like ONTP&RE? http://pcsupport.about.com/od/toolsofthetrade/gr/offlinentpwed.htm

January 10, 2010 at 3:45 pm
(79) Lance says:

After it finished ‘cracking’ the result was “Not found” in the NT Pwd column. What does that mean?

January 12, 2010 at 11:55 am
(80) Tim Fisher says:

@Lance: Pretty much what it says is what it means – it didn’t find the password. Most likely the password is too long or too complex. I’d try another program like ONTP&RE: http://pcsupport.about.com/od/toolsofthetrade/gr/offlinentpwed.htm

January 12, 2010 at 4:54 pm
(81) Xragoon says:

Yea, I need a tool that recovers passwords not deleting it. In the desktop when i boot the CD, am i suppose to type some special command in order to operate ophcrack. Because i don’t have that automatic startup for the hard drive partition

January 13, 2010 at 11:53 am
(82) Tim Fisher says:

@Xragoon: You’re not supposed to need to type anything at all. If it’s not automatically running then there must be some kind of issue. If I were you, I’d post about this on Ophcrack’s official support forum here: http://sourceforge.net/apps/phpbb/ophcrack/

January 22, 2010 at 10:15 am
(83) Joey says:

Tim, I bought a computer with Windows XP Home at a yard sale. There are two accounts on it, a user, without a password, and the admin, with a password.
I tried ophcrack and in a matter of 30 seconds it came up as ‘not found’.
Is that long enough for a brute force attack? Or is there perhaps some other problem preventing ophcrack from working?
Do you think it would help if I purchased additional tables?
Thanks.

February 14, 2010 at 5:06 pm
(84) Tim Fisher says:

@Joey: No, I don’t think that the brute force attack probably took place. And no, I don’t think purchasing additional tables would help. There might be some problem. Have you tried the Ophcrack forums for help or tried Offline NT Password & Registry Editor? (both linked in some of my replies above)

January 23, 2010 at 8:34 am
(85) Kellijuana says:

I recently locked myself out of my admin (gee who would have guessed) and had a geek squad member off-the-record recommend this site to me so I have it in my head to trust the program and try it. However, my mom and the IT guys at her work keep saying its dangerous as it will leave my computer vulnerable to hackers. All the debate has me worried. So, I have a few questions I’m hoping you can answer since you have so much experience with the program.
After I boot my computer with the ophcrack burned disc in, does it download anything on to my computer? If so can it be removed and how difficult/easily?
In your experience do computers seem more vulnerable/laggy/slow/etc after using the program? Have there been reports of people being hacked after using it?
When discussing options you mention that you can use one admin on a computer to change the pw of another admin on the same computer but that the user will lose access to something… or something like that… (I don’t have this option but,) are there any such effects after using ophcrack?
K I think that is all I am worried about. Thank you very much for all of your advice and for keeping up with peoples’ questions!! RAOK for sure! :D

February 14, 2010 at 5:08 pm
(86) Tim Fisher says:

@Kellijunana: No, nothing is downloaded to your computer if you use the LiveCD version – which is what everything I’ve written on Ophcrack suggests. No, you will so no difference in your computer. Ophcrack just reads the encrypted password information from the hard drive, decrypts it, and displays it to you. Nothing is written to the drive at all and you won’t lose access to anything. In other words – don’t worry about Ophcrack :)

February 1, 2010 at 1:13 pm
(87) liljohn9512 says:

ophcrack said it never found any partitions is there bany way that i can fix this?

February 14, 2010 at 5:24 pm
(88) Tim Fisher says:

@liljohn9512: Probably not – but you can get on the Ophcrack forums and see if someone else has had a similar issue. You might be better off trying another program – like Offline NT Password & Registry Editor (which I’ve linked to several times above).

February 5, 2010 at 12:34 am
(89) katiescarlett71 says:

Hiya! Here’s my concern: I put the Ophcrack LiveCD (Vista) into my drive, selected F12, boot from CD-Rom. It begins to work, gets to a page where it says something about partition hases and lists 2 of them as 0. and 1. Next line says to select one. So I typed the 0. at one point and also the 1. at one point (two different attempts) Neither of them do anything when I’ve selected either of them. Just tells me to exit (y/n) and then it logs me off. What in the world am I doing wrong?

February 14, 2010 at 5:26 pm
(90) Tim Fisher says:

@katiescarlett71: You’re probably not doing anything wrong. Ophcrack doesn’t always work with everyone’s PCs. Actually, the fact that it works with so many surprises me. Just try ONTP&RE: http://pcsupport.about.com/od/toolsofthetrade/gr/offlinentpwed.htm

February 5, 2010 at 4:50 am
(91) Shanka says:

Hi,
I downloaded the ISO image from sourceforge.net and burned it on to a DVD using Nero. When I rebooted my PC, I got an error saying: Solinux…something, peter anvin et all….

Boot failed: press any key to retry…

Any suggestions on how to make it work?

February 14, 2010 at 8:05 pm
(92) Tim Fisher says:

@Shanka: I’d try burning the disc again. If that doesn’t work, Ophcrack might just not be compatible with your PC. You could try the Ophcrack forums (linked to in various comments above) or you could try Offline NT Password & Registry Editor (also linked several places above).

February 9, 2010 at 2:52 pm
(93) mr. r says:

i put ophcrack on the disk but it didnt work. it boots fine and goes through everything but then it says no partitions containing hashes found. it stops here and exits and i get stuck in the linex thing. i have a windows xp with home edition on it.

February 14, 2010 at 8:09 pm
(94) Tim Fisher says:

@mr. r: I doubt you’ll get Ophcrack to work. I’d suggest trying ONTP&RE: http://pcsupport.about.com/od/toolsofthetrade/gr/offlinentpwed.htm

February 9, 2010 at 7:41 pm
(95) Jess says:

Hi
The ophcrack live cd on vista hasn’t found my forgotten password….. its comes up saying not found. Is there any other way to retrieve the password?

February 14, 2010 at 8:10 pm
(96) Tim Fisher says:

@Jess: There are other password recovery programs but they’re much harder to use. Your best bet is to use ONTP&RE editor, which I treat as a password “recovery” program even though it deletes the password instead of finds it. Regardless – it gets you in. See the various links in these comments to that program.

February 14, 2010 at 9:01 am
(97) andy says:

Tim,

administrator empty
guest empty
OEM (my id) not found
i`m using windows 7 and it doesnt find my password….please help me.or tell me another way to log in into my computer

February 14, 2010 at 8:13 pm
(98) Tim Fisher says:

@Andy: Ophcrack won’t work for you. My guess is that your password is too long or complex. Try ONTP&RE instead: http://pcsupport.about.com/od/toolsofthetrade/gr/offlinentpwed.htm

February 19, 2010 at 1:23 pm
(99) liljohn9512 says:

i need to find the password not delete it im working on somone elses computer. they dropped it off with me to fix it then went on vacation to hawaii. they want it fixed when they get back any other programs?

February 22, 2010 at 8:54 am
(100) Tim Fisher says:

@liljohn9512: Ophcrack is the only easy + free program that’ll do this.

February 22, 2010 at 1:26 am
(101) Nomad says:

I’ve burnt the ISO file on a disc and have literally everything setup… but I am running an Intel MacBook Pro. I obviously don’t have BIOS, I have EFI. What do I do? Run the program or…?

February 22, 2010 at 9:07 am
(102) Tim Fisher says:

@Nomad: Just so I’m clear – you’re running Windows on an Intel MacBook Pro as a bootable OS? (i.e. not in Parallels or something like that) You’re not trying to crack an OS X password with Ophcrack, right?

February 25, 2010 at 12:35 pm
(103) liljohn9512 says:

dangit i need this done soon and i lost the password they left me with are you sure there is no other free programs that do this without deleting the password? i work on computers all the time i think this will help me quite a bit but i tried it on four computers and it still hqasnt worked. also could it possibly work in text mode. i tried it but got lost. is there any thing that i can try to help?

March 7, 2010 at 7:01 pm
(104) chaston says:

I’ve used ophcrack repeatedly on a laptop to try and recover my friends long lost password but I haven’t had any luck. It will bring up his user name, the LM and NT hash, and the number 21 in the LMPWD2 column but 21 isn’t the password and I’m not sure what else to do.

March 10, 2010 at 9:40 am
(105) Tim Fisher says:

@chaston: Ophcrack is far from perfect – it by no means cracks all passwords and sometimes simply doesn’t work. I’d suggest asking this question in Ophcrack’s official forums (linked in previous comments) or trying ONTP&RE, a program that resets passwords (also linked in previous comments).

March 20, 2010 at 1:51 am
(106) Ryan says:

Hi, i got up to here on someone else’s pc. http://pcsupport.about.com/od/toolsofthetrade/ss/ophcracksbs_9.htm. (They wanted me to do it) it gets up to about 80% and 2/5 pw found and then the screen dissappears. it worked on my pc. why not theres?

March 25, 2010 at 9:50 am
(107) Tim Fisher says:

@Ryan: Ophcrack really is hit-and-miss. Remember, the CD is running a copy of Linux that includes a set of drivers that “should” work with “most” kinds of computers. The fact that it does weird things on one PC and not another is not at all strange considering that. I say use the ONTP&RE program that resets passwords instead. Might not be what the other person is looking for exactly but it almost always works.

March 20, 2010 at 2:39 pm
(108) nicolas says:

hi, i burned the CD correctly, and set CD-drive first, when i start my laptop nothing happens… he just starst like he normaly does, what do i have to do?

March 25, 2010 at 9:51 am
(109) Tim Fisher says:

@nicolas: Just doublecheck everything to be absolutely sure. Make sure you burned the ISO image to the CD and not just the ISO file as a data file. Make sure your CD drive in your laptop is working (might want to remove/reinsert it).

March 27, 2010 at 8:22 pm
(110) Kellijuana says:

Hey :) Me again, thanks so much for the reassuring info. So I tried ophcrack and lo and behold… my password was too complicated :( yaaaay… (It’s most likely in the form word##word) And now my antivirus is expired and I need to remove it and reinstall which… can’t be done without my password :P
When I ran the program it gave four user logins, my administrator which has my name, my two other family logins and another admin. I wasn’t aware that there was another admin and it doesnt show up on the blue screen that gives you the account options. Is there some way for me to access this admin and reset my login from it? Or is this just a ‘ghost’ type account?
I think I’ll try the NT program next since it should erase my pw regardless.
Thank you again! :D

March 29, 2010 at 5:18 pm
(111) Rick L says:

I used Ophcrack on mine and it said it was empty.All I need to do is press enter,but my display still shows administrator and password.I even tried Offline NT and it said there was no password but I’ve got to have one according to XP.

April 1, 2010 at 9:54 pm
(112) Javier U says:

Hi, Tim I have a problem and I hope you can help me i have burn the ISO file, actualy I manage to put the files on a USB and work perfectly until the last window the launch.sh where it said no tables found !! I press enter and the program is working but the linux program is difrent, it’s the one that saids ophcrack LiveCD running on…. Slitaz, so what’s next to recover the password.

April 5, 2010 at 9:11 am
(113) Tim Fisher says:

@Javier: Have you tried it with a CD? I know it shouldn’t matter but maybe using it on a USB drive introduced a variable that isn’t obvious right now. Other than that, I haven’t seen a clear cut solution to these “no tables found” problems. You could try posting on Ophcrack’s official forums (linked in previous comments) or skip the program entirely and use ONTP&RE (also linked in previous comments).

April 27, 2010 at 9:53 pm
(114) Rey says:

Hi
I made a bootable USB for Acer with Vista home premium. After a few burning tries, It boots right ..visual screen comes up and then it starts … hangs at some module –
“Call Trace ………….end Trace 4eaa 2a86 a8e2 da22″

And Nothing Happens. Any remedies to make it work?

Thanks, R.

April 28, 2010 at 10:23 am
(115) Tim Fisher says:

@Rey: I’ve personally never seen that one so my guess is that it’s either 1) something to do with the process of putting the program on the flash drive or 2) Ophcrack just hates your PC (this happens a lot).

Two options: Post on the forums at Ophcrack’s site or use ONTP&RE instead.

May 3, 2010 at 10:58 pm
(116) Jeric says:

hi..same as andy…im running windows 7, but no password window is being displayed upon booting.

May 15, 2010 at 1:34 pm
(117) hass says:

thanks tom for the guide im using the live cd for vista on my windows 7 and when i run it i get an error like input/output something… please help!!

May 16, 2010 at 2:59 pm
(118) Tim Fisher says:

@hass: Check out the other program I’ve linked to several times in the other comments. It’s an excellent second choice if Ophcrack doesn’t work out, which it often does not.

May 28, 2010 at 8:52 pm
(119) Tables Proble says:

Hey Tim,

I did up to http://pcsupport.about.com/od/toolsofthetrade/ss/ophcracksbs_8.htm, but the tables was never found. What should I do?

May 29, 2010 at 4:02 pm
(120) Tim Fisher says:

@Tables: Did you download and burn the correct ISO file for you operating system? There are lots of reasons this might happen and Ophcrack itself is hard to troubleshoot. If you’re up for a more manual process, I say try ONTP&RE: http://pcsupport.about.com/od/toolsofthetrade/gr/offlinentpwed.htm

June 6, 2010 at 10:17 pm
(121) Karen says:

Ophcrack can’t find my password (it was a long phrase, stupid me can’t remember it!) I want to use offline nt, but need to boot from USB due to dead cd rom drive. When I followed the instructions, it says it can’t load one file, named “r”, I exit that error message and it finishes copying the rest of the cd files to the usb, but then it doesn’t boot the PC in question. Any help??

June 6, 2010 at 11:08 pm
(122) Karen says:

Oh, and the readme.txt file says to “2. Install the bootloader (you may have to be administrator)
On the USB drive, there should now be a file “syslinux.exe”.

Where do I get the bootloader?

June 7, 2010 at 1:43 am
(123) Karen says:

Never mind! I had a litebulb moment! All is well!

June 7, 2010 at 3:35 pm
(124) Tim Fisher says:

@Karen: Glad to hear it! :)

June 10, 2010 at 3:48 pm
(125) ren says:

d5a11e58ebc09b7a5f7378502f08cb47 I got this code, could you decrypt it for me [please?

June 10, 2010 at 3:50 pm
(126) Tim Fisher says:

@ren: Just use another password recovery tool if Ophcrack didn’t work. Try ONTP&RE: http://pcsupport.about.com/od/toolsofthetrade/gr/offlinentpwed.htm

June 10, 2010 at 3:54 pm
(127) ren says:

does it just delete passwords? I need one that displays them :(

June 10, 2010 at 4:15 pm
(128) Tim Fisher says:

@ren: Ophcrack recovers passwords. ONTP&RE deletes them.

If Ophcrack isn’t working the way it should, try posting on their forms: http://sourceforge.net/apps/phpbb/ophcrack/

June 25, 2010 at 5:23 pm
(129) blah says:

hey tim having a bit of trouble with ophcrack livecd and usb, the program cant seem to see the harddrives on the computer, so had a look at other live cds , versions of linux, none can see the harddrives, was wondering wat ur take on this could be… any ideas how to solve this?

June 25, 2010 at 5:42 pm
(130) Tim Fisher says:

@blah: I have a few ideas. 1) There’s just something wrong with your computer (unlikely if it’s otherwise working fine). 2) The version of Linux that Ophcrack runs on top of uses a similar hard drive controller driver to access Windows partitions as other Linux versions do. That driver must just not be compatible on some level with the controller used on your motherboard. I have seen this happen before.

Your options? Probably not many. You could try ONTP&RE (linked numerous times above) but I know that one is similar as well. You might get lucky though.

July 2, 2010 at 7:09 pm
(131) Anthony says:

Robert if u lost the bios or start up password simply crack the case and pop out the CMOS battery! It looks like a coin it’s silver and all the modified start up files are stored on there. Leave it out for 10-15 minutes with the computer power cord unplugged!! That should do it

July 6, 2010 at 2:40 am
(132) kahhang says:

Hey i need serious help! My father set a password on my computer and i no longer have access to it. Everything works fine for me untill http://pcsupport.about.com/od/toolsofthetrade/ss/ophcracksbs_9.htm . I get the screen but it doesnt progress. It just stays there and stuck. How!!

July 11, 2010 at 3:46 pm
(133) Tim Fisher says:

@kahhang: I don’t know your situation, but if you’re OK with having the password reset/removed (i.e. your father will know you’re now in the computer because the password will be different) then you should try ONTP&RE, linked several times throughout the comments.

July 15, 2010 at 3:12 am
(134) Alex Woodland says:

Hi Tim, I was wondering if when you download the iso file from sourceforge you have to extract the files to burn them on the CD? Thanks.

July 15, 2010 at 10:32 am
(135) Tim Fisher says:

@Alex: Not exactly. You have to bun the ISO file as an image to the CD… it’s similar to extracting the files manually and then burning the extracted files manually to a CD but you don’t always preserve boot information when you do that.

The solution is to extract/burn the ISO file to the disc in a single motion via a burning tool. It’s called “burning an image” to a CD. Most burning programs do this like Nero, etc. There are plenty of free ones too. My tutorial I link to from my Ophcrack review recommends one. There are others too: just search free image burner in your favorite search engine and you’ll find plenty.

July 19, 2010 at 4:57 am
(136) Alex says:

I have the same Issue as Sam.

Tested the XP boot cd, works 100%
Tested the vista boot cd, used under win7, password not found.

When I booted the USB, it gave me a white screen. When I pressed enter he prompts me for a boot password (passwords are disabled in BIOS).

Since the normal Vista bootCD failed to find the password, I will add the Vista special (8GB) and the vista Num (3GB) table and see if that works.

However, for that I need to boot my 16GB USBstick. Which gives me the white screen that “Sam” also had.

July 20, 2010 at 1:43 am
(137) Alex says:

Formatted the USB with your HP tool; reinstalled it.

Now it still gives me a white screen with unreadable letters, but I can get past it. and it ends op a prompt which says

“Boot:”

No clue how you proceed from there…

July 20, 2010 at 3:08 am
(138) Alex says:

Sorry to trippel post, but last USB boottest was on XP.

On Windows 7, the USBboot asks a password. All passwords are disabled in the BIOS.

Sad I can’t get it to work for windows 7, it works great for XP.

July 22, 2010 at 5:34 pm
(139) Tim Fisher says:

@Alex: I’ve certainly heard many the report about issues with Windows 7, but I don’t have as bad a luck with my attempts. Have you tried posting on Ophcrack’s official forums for an answer?

July 31, 2010 at 8:40 pm
(140) Marissa says:

hey, i cant seem to find my password, i tried every mode for ophcrack and the only one that remotely work is txt mode, but it says password stored in tmp.ophcrack.txt and i cant find that

August 1, 2010 at 10:19 am
(141) Tim Fisher says:

@Marissa: The version of Linux that Ophcrack runs on probably just doesn’t like your video card. Try one of the other programs I linked to in the recent edit in the body of this post.

August 3, 2010 at 6:51 pm
(142) toxikomx says:

hey! tim.. how can i recover a rar password using ophcrack? if you know how to do. please send me the answer to my email. ok?? thanks. my email is : toxikomx@gmail.com

August 3, 2010 at 7:27 pm
(143) Tim Fisher says:

@toxikomx: Ophcrack doesn’t recover passwords from RAR files – it only recovers Windows logon passwords. I don’t have a recommendation either. A quick Google search turns up, what looks to me like, a bunch of not-so-promising results.

August 4, 2010 at 1:01 am
(144) Joey says:

Everything seems to work ok, but when the progress shows about 60% of finding the password, the computer just turns off. Is there anything I can do?

August 4, 2010 at 9:29 am
(145) Tim Fisher says:

@Joey: Probably not, unless you’ve been seeing this kind of behavior during your normal Windows use. If not, the problem lies with Linux or Ophcrack on the CD which is going to be difficult to troubleshoot. Just try one of the other programs.

August 7, 2010 at 3:27 pm
(146) binet says:

ophcrack don’t work for password beginning with a number

August 8, 2010 at 9:48 am
(147) Tim Fisher says:

@binet: Do you know that for sure? If you have some way to confirm that that’s true (a mention on Ophcrack’s site is fine) then I can update my review and other documentation.

August 12, 2010 at 12:03 pm
(148) Vijay says:

Hi Tim i use windows 7 so i downloaded ophcrack vista 2.3.1 from a torrent(could not download from the website coz my connection disconnects again n again)i copied all contents of the iso to a flash drive but when i booted from it a black screen came and said disk error press any key to retry when i press any key same message please help

August 12, 2010 at 2:04 pm
(149) Tim Fisher says:

@Vijay: You can’t just copy the ISO file contents to the flash drive and expect it to boot, as logical as that might seem. (It should work like that, shouldn’t it?)

Ophcrack’s FAQ has the answer: http://sourceforge.net/apps/mediawiki/ophcrack/index.php?title=Frequently_Asked_Questions (see section 1.8.1)

August 18, 2010 at 5:31 pm
(150) Camille says:

hello i have a problem with ophcrack too
i downlaod it really well after i put the cd and it worked
but after the black all the white writes its putting me to a page call ophcrack live cd running on slitaz(some thing like i’m not completely sure with a spider )
and when i get there i dont know what to do…
i try to open ophcrack it worked but it does not want to start

August 20, 2010 at 10:00 am
(151) Tim Fisher says:

@Camille: Starting here and working through the remaining steps, what exactly isn’t the same in your case?

August 24, 2010 at 7:38 pm
(152) Matt says:

Ophcrack can only find the password for 1 out of the 3 users on my laptop. How can I make it find all of them? Thanks in advance.

August 25, 2010 at 9:57 am
(153) Tim Fisher says:

@Matt: The one user probably has a more simple password than the other two. You’d need to use a bigger/better table ($$) in Ophcrack.

August 28, 2010 at 12:29 pm
(154) Matt says:

The tables there are expensive. Are there any other ways I can fix this problem without buying those, or should I switch to an alternative password recovery program?

August 30, 2010 at 11:05 am
(155) Tim Fisher says:

@Matt: Try another one. That’s your best bet.

August 31, 2010 at 3:14 pm
(156) Vid says:

I have windows XP and windows 7 installed on my computer. Do i have to use the same process or is there any aditional steps?

September 1, 2010 at 10:00 am
(157) Tim Fisher says:

@Vid: There are different downloads for Windows XP vs Windows Vista/7. Just download the one for the operating system you need to find the password for a user on. You might run in to an extra step here, possibly having to select the correct partition.

October 4, 2010 at 1:52 am
(158) Tommy1 says:

Question: What is the maximum length that Ophcrack will recover on an XP machine? And what is the logic there?

Thanks for any help…I couldn’t find anything on the Ophcrack forums.

October 4, 2010 at 12:33 pm
(159) Tim Fisher says:

@Tommy1: It seems that the answer is 14 characters and the logic is how the Rainbow tables are designed. Here is a discussion that might be interesting to you, as would this one.

October 4, 2010 at 3:41 pm
(160) Tommy1 says:

Thanks, Tim. A student at my father’s private academy locked an account on a shared laptop and we were trying to crack it without wiping the other accounts’ passwords.

Ophcrack wasn’t successful and I figured it was length and not complication. Anyway to increase the length of password ophcrack will find? Doubt it, but worth asking.

October 4, 2010 at 4:42 pm
(161) Tim Fisher says:

@Tommy1: I don’t think there’s a way to increase the length without using a Rainbow table that’s designed to do so. Assuming one exists (which I’m not totally sure does), it would certainly cost a pretty penny. Though I suppose I’m just assuming that too.

Is there a reason you need to discover the password verses just reset/clear the password? You can do that with PC Login Now or ONTP&RE – no length or complexity issues because it just removes the password. Neither tool will disturb other accounts as long as you don’t make changes to them. Personally I prefer ONTP&RE even though it’s a bit harder to use.

October 5, 2010 at 7:13 am
(162) Burtinsh says:

It is nice thing, but I have problem runing it 2nd time.. It is working, but displaying only few parts of password.. May I download It once again, or it will start work sometime?

October 6, 2010 at 9:54 am
(163) Tim Fisher says:

@Burtinsh: It worked the first time but not the second?

October 13, 2010 at 7:55 pm
(164) me says:

can opcrack get trough bios?

October 16, 2010 at 1:10 pm
(165) Tim Fisher says:

@me: No, Ophcrack will not crack a BIOS password.

Some motherboards have specific jumpers designed to clear the BIOS password. Otherwise, clearing CMOS is your other shot.

October 13, 2010 at 10:44 pm
(166) jo says:

I tried to use ophcrack for Vista — the CD burned fine and appeared to be working but then I got the following error:

Problem while preloading table Vista free,2 at file 3.
Input/output error
Problem while preloading table Vista free,3 at file 1.
Input/output error
etc….

Is there some way to get around this?

October 16, 2010 at 1:12 pm
(167) Tim Fisher says:

@jo: Not that I’m aware of. Read my “Edit (July 31, 2010)” at the bottom of the post for options.

November 2, 2010 at 7:11 pm
(168) frustrated says:

I can retrieve my admin password after running this and everything seems to be fine, BUT when I then try to log in with the password provided I’m told it isn’t correct….any suggestions? thanks for your help.

November 3, 2010 at 11:53 am
(169) Tim Fisher says:

@frustrated: What OS are you using? Is the password you got actually for the “Administrator” account and then did you use it to log on to the actual “Administrator” account?

December 6, 2010 at 7:22 am
(170) Hamadouch says:

Hi Tim,

I have a problem in booting the Live CD to a DELL optiplex320.
The system boot on the CD but ask me to hit “Enter” to continue and freezes.
I’m using the livecd1.0 and it worked fine with an optiplex GX520.
Have you any suggestions ? thank you in adance

December 6, 2010 at 10:01 am
(171) Tim Fisher says:

@Hamadouch: The LiveCD version is running at 2.3.1 now so I’d try that new version first. Chances are, the problem is due to Linux not having a compatible hard drive controller driver or some other driver necessary to work on that particular model. V2.3.1 might have fixed that, it might not have. Try the other programs here too if nothing else works.

December 14, 2010 at 2:19 pm
(172) irving says:

Hello Tim,
Found your information and wanted to say thanks for putting this info out there.

I noticed on the orhcrack website there are other tables for windows xp and vista. How do I add those tables to the iso file or are they already installed?

December 14, 2010 at 3:15 pm
(173) Tim Fisher says:

@irving: The ISO file (LiveCD version of Ophcrack) is completely self contained and the tables are included. The only real difference between the XP and Vista/7 downloads is the different table. The program is the same. So just burn that ISO file, boot to it, and off you go.

December 14, 2010 at 3:33 pm
(174) irving says:

Thanks Tim. I did run it on a pc to test the program before I do it on a friends computer. On my pc the admin and two other accounts show, but under NT pwd column it is blank. Except for guest that shows empty. I guess this means that it did not find the passwords. After the program runs, a dos screen shows some info like found one partition that contains hashes. then five other lines starting with starting ophcrack and the next two lines say failed and the third a number then killed. Does this mean the program ran successfully and just couldn’t crack the password?

December 14, 2010 at 5:21 pm
(175) Tim Fisher says:

@irving: That’s my guess. If you didn’t see any errors or a stray from the tutorial, the program just couldn’t do the job on your computer. Probably an indication that your password(s) are in good shape security-wise. Hopefully it’ll work on your friend’s PC but if not, and if a password reset/delete will do just as well, take a copy of ONTP&RE with you as well… maybe even PC Login Now as a third option. Better safe than sorry. Both are linked in the blog post WAY above.

December 14, 2010 at 6:10 pm
(176) irving says:

Thank you Tim. That is what I suspected. I was going to take the other programs you suggested also. Have a great day.

January 29, 2011 at 1:44 am
(177) Jake says:

my son tried using it with a USB, now everytime you boot the comp. it stays on opcrack. How do i access the original windows. cant get it back to work.
pls help anybody.

thanks

January 29, 2011 at 10:14 am
(178) Tim Fisher says:

@Jake: It would be difficult for your son to “install” the bootable Ophcrack on the hard drive. So my guess is that you still have the USB drive or maybe a disc with Ophcrack on it in the drive and it’s being booted to. Remove the USB drive and any discs you have in any drives and then reboot.

February 20, 2011 at 2:23 pm
(179) Jou says:

hi tim

i have done everything but now it say not found what now?

February 20, 2011 at 6:43 pm
(180) Tim Fisher says:

@Jou: If Ophcrack seemed to run correctly but it didn’t find the password, it means that it’s too complicated or too long for the program to crack. You’ll need to try ONTP&RE or PC Login Now to reset the password instead of recover it. See note #4 in the blog post.

February 23, 2011 at 4:06 pm
(181) JB says:

Downloaded, correct MD5′s for XP and Vista LiveCD, and built bootable disks. On a Windows XP machine I get the full screen, 1 bruteforce (4 character), 2 empties and 6 “not found”. XP does not have policy or registry hack to prevent LM Hash. LM Hash column is empty. Ran the disk on another XP machine and it worked fine. The LM Hash column was filled in and the NT hash column was the same for two accounts with the same password as first XP.
Any known bugs or fixes to get the LM Hash column to fill in. Like on the online demo only the NT hash produces “not found”. If the full LM:NT is used then the online demo yields the correct password.
Just ran the same CD on a third XP laptop and it gets to the main screen and starts loading. It gets to a section on USB stuff and hangs. I removed the USB mouse and it got further. I disconnected the USB printer and got further. Nothing left to disconnect so it never worked.
Is there an option to use a PWDump (which is the best version?) to retrieve and then use the CD or online demo to crack the password?

February 23, 2011 at 5:19 pm
(182) Tim Fisher says:

@JB: Ophcrack is tricky and seems to support less and less hardware that’s found on a typical Windows machine. The Linux drivers probably need a healthy update. I don’t spend too much time troubleshooting it anymore and I usually head right on to the reset programs (my replies to your comments on that in a minute).

As far as PWDump – I have little experience with the best version of that to use, nor have I seen any reliable demos to crack the password. You could try a service like http://www.loginrecovery.com/ which (as far as I can tell) works by sending them the encrypted password file and then they crack it and send you the result. I think it costs around $35 USD though I’m not seeing that on their site anymore – nor am I seeing that it’s suddenly a free service, either.

To your second comment: A reset tool shouldn’t risk loss of access unless there is encryption as you mentioned. It shouldn’t effect group/user security but I haven’t personally tested this to be 100% sure. It’s essentially the same as resetting another user’s password via an admin account in Windows so one could certainly setup an easy test.

I’m also not sure if there’s a way to test for encryption prior to a reset. I usually rest on the “if you don’t know what EFS is, you probably didn’t encrypt anything” but I don’t know what your situation is like.

The admin reset -> user reset file encryption question I sort of answered – no, you’ll still lose access to encrypted files. The user’s password is explicitly tied to the encryption so if the password changes, the access is lost, even if another admin on the machine does it.

I see your final comment now. Here’s what I’d do: It sounds like there might be an admin user on this computer aside from the user account with the files in question, no? If so, access that account (or reset the password if you don’t know it) then use that admin account to look at the critical files for encryption status.

Let me know if I can be of more help. I know these things are tricky.

February 23, 2011 at 4:11 pm
(183) JB says:

If Ophcrack does not work on a machine does a reset tool risk loss of access to user files?
Is this true for group and user security for file access or only to encrypted files like EFS and Bitlocker?
Any way to assess if and what file encryption exists prior to reset of the user password?
Can resetting the admin user allow the admin to reset the user password that has all the files without losing access to encrypted files?
Please advise as these are critical files for our business and the user has passed away so there is no turning back.

April 3, 2011 at 1:31 am
(184) Michael says:

Hey Tim, I’ve been having problems with Ophcrack Vista LiveCD working for Windows 7 as well. It runs perfectly off my USB, but it can’t seem to find the password for my accounts. After the process finishes, I just get a red “not found” under NT Pwd. Is there anything I can do about this?

April 3, 2011 at 9:13 pm
(185) Tim Fisher says:

@Michael: Assuming you see it trying for a while and THEN failing, my guess is that the password is too long or too complex for Ophcrack to crack. You’d have to find a Rainbow Table that was bigger (and even then it might take YEARS to find the password or YEARS of trying and still failing) or you’ll have to use a password reset program like the others listed in the original post.

April 7, 2011 at 4:00 pm
(186) Richard77 says:

ok i burned the iso fine, it worked the first time i booted from cd however, i think it disabled my graphics card display. I can boot in safe mode just fine, but normal vista boots to a black screen. Why did it do that & how to fix it?

2) orphcrack did not list the user acct that i need to access. Is it possible that vista calls the acct by another name? FYI, orphcrack still did not recover any passwords for any accounts on my vista laptop. ** Help me

April 7, 2011 at 8:07 pm
(187) Tim Fisher says:

@Richard77: I’ve never heard of Ophrack doing something like that, nor does it make any sense considering how Ophcrack works. I’d lean toward a coincidence or a previously existing problem. To the second question, if the user account wasn’t even listed then it means that Ophcrack simply didn’t see it. That could be for lots of reasons but most likely because the account is having some kind of problem.

Are there any computer problems going on with this machine or as far as you know is it just a forgotten password that’s keeping you from getting in (prior to the black screen issue of course)?

April 16, 2011 at 12:40 pm
(188) Brian says:

I managed to get it to the part where it actually found the passwords but unfortunately it ended up not finding any of the passwords. Was I supposed to manually set up the hashes for it or something? Sorry if this ends up being a dumb question, I’m trying to teach myself about computers and hacking and such and its not working out.

April 17, 2011 at 7:40 pm
(189) Tim Fisher says:

@Brian: Chances are you did nothing at all wrong. The most probable answer is that your password was a) too long (greater than 14 characters) and/or b) used characters that Ophcrack doesn’t look for. Just a limit of the program… and any true “recovery” program unless you want to pay for a bigger table and even then, it could take a super computer a thousand years to find it if it’s long and complicated enough.

April 18, 2011 at 1:28 pm
(190) keith says:

Been looking around online and cant seem to find much info. I am running this program, everything boots up fine. goes into dos and runs all the prompts, then it gets to linux live end, starting the linux distribution. It goes down a couple more lines then seems to stop at triggering udev events: /sbin/udevtrigger. Any ideas as to where to go from here? I read somewhere that the floppy drivers should be disabled, so i did that in the bios but still no go. I have let it go for over an hour and nothing seems to happen after this. Thanks in advance for any help given.

April 19, 2011 at 10:18 am
(191) Tim Fisher says:

@keith: This is probably due to the Linux OS on the disc simply not supporting your hardware in some capacity. In other words – you’re probably out of luck unless you know how to slipstream Linux drivers into the LiveCD and then compile your own disc. The other programs I linked to in the UPDATE to this original post might work, though they’re all “reset” programs – they won’t actually find the password.

May 1, 2011 at 11:21 am
(192) Joe says:

Hi im new to ophcrack live cd and i would like to know how to update the mozilla firefox because each time i update it then when i logout and login again i have to do everything again? Also how can i update the ophcrack?

May 1, 2011 at 8:58 pm
(193) Tim Fisher says:

@Joe: I’m a little confused about what you’re asking. Are you having an issue with Firefox repeatedly asking you to update? If so, what does that have to do with the Ophcrack ISO image download?

May 3, 2011 at 2:47 am
(194) Darshana says:

I have downloaded Ophcrack for xp and it works very well.first thanks for that.

Then I have downloaded Ophcrack for Windows 7.But when booting from live cd,It says “Could not find kernel image :linux ”
I have tried for several computers.But same results.Couldn’t get any help from Ophcrack Forum.

Is it Error of cd?Or Software?

Please help me.

May 3, 2011 at 7:49 pm
(195) Tim Fisher says:

@Darshana: Did you try the Ophcrack disk on several of the same types of computer? It’s possible that the drivers included in the LiveCD version of Linux just aren’t compatible with the hardware in the computers you tried it on. Just a thought.

May 19, 2011 at 5:52 pm
(196) noobie says:

i used my OPHcrack CD, and everything runs well, except it always says, PASSWORD “not found” what am i supposed to do to fix this? I’m using windows 7, or is it just because windows 7 passwords can’t be recovered?

May 19, 2011 at 7:17 pm
(197) Tim Fisher says:

@noobie: Did Ophcrack do some searching and then provide that response or did it show up like that immediately?

May 20, 2011 at 3:14 am
(198) noobie says:

ummmm, after brute force couldnt find it, it also searched through hte long process of the 100% RAM thing. After all that was done, it still couldn’t find the password

May 20, 2011 at 8:45 am
(199) Tim Fisher says:

@noobie: Then Ophcrack did all it could and you’ll need to try a password resetting program instead. If the password is too long or too complicated, it just won’t do it.

May 30, 2011 at 9:01 am
(200) Taicheng says:

I have downloaded ophcrack-vista-livecd-2.3.1. The file came as a zip file. I extracted them by winzip. It contains BOOT,TABLES and MD5SUM. Now how can I burn ophcrack to a cd ?

June 3, 2011 at 10:02 pm
(201) Tim Fisher says:

@Taicheng: Don’t extract via WinZip. Just burn the ISO file to a CD using the image burning feature of your CD/DVD/BD burner program.

June 27, 2011 at 8:29 am
(202) Vaibhav says:

“Got the ophcrack program to run just fine but it said password not found on Windows 7. Any ideas on how to get it to work with Windows 7?”

June 27, 2011 at 11:09 am
(203) Tim Fisher says:

@Vaibhav: That means Ophcrack isn’t going to work for you. Either the password was too long or too complicated to decipher.

June 28, 2011 at 5:10 am
(204) Vaibhav says:

Can this problem be solved with the help of any other tables.

June 28, 2011 at 11:31 am
(205) Tim Fisher says:

@Vaibhav: Yes, a larger table might help. It would have to be almost infinitely large and you’d have to have an infinite amount of time to guarantee that Ophcrack would find the password, two scenarios that are of course impossible. But – yes – a larger table might do the trick… completely depends on the password length and complexity.

August 9, 2011 at 11:25 am
(206) Daniel says:

Hey guys,

Ophcrack works with win7 but the thing is it cant find simple pws like “politie” cops in dutch. Does anyone have an answer ?

August 9, 2011 at 12:25 pm
(207) Tim Fisher says:

@Daniel: My understanding is that Ophcrack can crack just about any Windows XP password because of an issue XP had. That issue doesn’t exist in Windows Vista or Windows 7, so instead of exploiting a weakness in those operating systems, Ophcrack has to litterally make guesses at the password, meaning the guesses have to come from some predefined list (the table). My guess is that “politie” is not in the table because the table is primarily English words. There may or may not be a free or pay-for table that has common Dutch words.

August 12, 2011 at 2:34 pm
(208) anon says:

i have a problem i run the cd and all that but when the linux slitaz os comes up ophcrack doesnt come up and when i go to run and run ophcrack im all confused i downloaded the tables im using vista and i dont know how to get the hashes or whatever please help

August 12, 2011 at 2:58 pm
(209) Tim Fisher says:

@anon: Just to be clear: all you need to do is download the right LiveCD ISO file (XP for XP, Vista for Vista or 7), burn the image to a CD, boot to it, and let it happen automatically. No need to download extra tables or do any manual work to get the password hashes.

So, if Ophcrack isn’t starting automatically, something is up. Re-download the ISO, re-burn the image, and try again. It also might be having an issue working with your particular computer and if that’s the case, your best bet is just to try another tool (listed in #4 in my post).

August 14, 2011 at 8:45 am
(210) Adran says:

I’m trying to boot frm usb. It states to install bootloader, where do I find the bootloader?

August 14, 2011 at 2:17 pm
(211) Tim Fisher says:

@Adran: Did you follow the instructions to put Ophcrack on a USB drive here?

September 2, 2011 at 12:05 am
(212) christian says:

Hi there i downloaded ophcrack live cd for windows 7 and ran it just fine. the only problem is it cant find ANY of my passwords. If you could give me some pointers, I would greatly appreciated.

September 2, 2011 at 6:54 pm
(213) Tim Fisher says:

@christian: If Ophcrack ran and simply didn’t find the password (no errors or anything like that) then you’re just out of luck with this tool. It only finds relatively simple and relatively short passwords. You could purchase a “word list” that would expand its capabilities but it’s not easy to slipstream into the bootable disc, nor is it guaranteed to work. Your best bet: Try one of the password RESET programs (no, they don’t find, they just delete the password). They almost always work.

September 12, 2011 at 6:17 pm
(214) Lorene says:

Once I am in the final step, where it’s actually looking for passwords, how long should this take to complete? It’s been searching for the password to the username that I need for about 13 minutes now and has been stuck at 72% for several minutes. Is this normal?

September 13, 2011 at 11:06 am
(215) Tim Fisher says:

@Lorene: You posted this last night – is it still running? Did it find the password? Normally I’d expect it to run at a maximum of twenty to thirty minutes, sometimes much faster if it’s found the password or the computer is very fast.

October 2, 2011 at 7:56 pm
(216) Chris says:

Hi i downloaded the Ophcrack XP because I forgot the administrator password to a laptop with windows XP Professional. After it boots from the cd, a textbox appears and says “no partition containing hashes found!!”. What can i do?

October 3, 2011 at 11:37 am
(217) Tim Fisher says:

@Chris: This usually means that, for whatever reason, Ophcrack can’t find the encrypted password information on the partition containing Windows or maybe that it couldn’t even find the partition at all. This could mean that there aren’t Linux drivers compatible with your hard drive controller on the LiveCD. There’s not much to be done unless you want to get in touch with the Ophcrack folks at their forum and try to troubleshoot the issue a bit more than I’m able to help with.

October 7, 2011 at 9:14 pm
(218) yui says:

no password shows after the windows 7 user is cracked adminstrator is empty
how do i use it?

October 10, 2011 at 11:15 am
(219) Tim Fisher says:

@yui: So Ophrack says it cracks the password but it doesn’t show anything? Or does it say empty?

October 14, 2011 at 3:06 pm
(220) Curtis says:

The NT Pwd says it’s empty for Admin, Guest, and my user. So went to login, I left the password blank, but all of them are looking for a password. Even when I go through safe mode. Forgot to mention, I’m using Windows XP.

October 16, 2011 at 4:06 pm
(221) Tim Fisher says:

@Curtis: Did you try PC Login Now? Might want to do that next and see what you get that way.

October 18, 2011 at 4:09 pm
(222) jayden says:

Hi i have tried several times burning the iso file of ophcrack to a cd but when i boot from cd in the bios it gives me a message saying error 32. I am going to try other burning programs because nero doesnt read the iso file properly before its burnt

October 18, 2011 at 4:32 pm
(223) Tim Fisher says:

@jayden: Yes, that’s what I’d try. Give one of the free ISO burners a try. Free ISO Burner… funny name, hu? ;) … is probably the best.

October 19, 2011 at 12:19 am
(224) George Daniels says:

Hey Tim.

I have made a disc of the Vista image to recover my password on my Win 7 PC. My computer has 3 hard drives with my OS running of just one.

I am able to boot just fine from the disc, however, when it searches for locked partitions, it finds none. Then, when I use the partition viewer to see what hard drives and partitions are recognized, my OS drive does not show up at all while all my other drives, including my USB flash drive do!

Any idea what the issue might be?

Thanks!

October 19, 2011 at 2:54 pm
(225) Tim Fisher says:

@George Daniels: Hmm… not sure what’s going on. I say make Ophcrack’s job easier – turn off your PC, unplugg all the drives except the one that has Windows on it, also remove the USB flash drive, and then boot to the CD. Let me know how that goes.

October 28, 2011 at 2:44 pm
(226) Gary says:

This is for anyone who has had the error “could not find kernel image” when using ophcrack on a bootable USB. First thing, very important: format your USB to FAT, not FAT32. Then use tazusb (http://www.objectif-securite.ch/slitaz/tazusb.exe) to install the Live CD iso (http://ophcrack.sourceforge.net) to your USB. If you are still having the error follow these instructions:http://www.pendrivelinux.com/error-could-not-find-kernel-image-linux/. If it still doesn’t work, your computer probably just hates you :\

November 27, 2011 at 1:56 pm
(227) larry says:

Dear Tim,

When I try to crack my password its says its empty but when i go to log in it says i need a password PLEASE HELP ME!!

November 30, 2011 at 11:29 am
(228) Tim Fisher says:

@larry: When you log in, you’re using your user name and leaving the password blank (not a space, don’t enter anything), correct?

December 10, 2011 at 4:39 pm
(229) Rafaul says:

hey i have problem no bootable partition in table what i have to do?

December 15, 2011 at 1:34 pm
(230) Tim Fisher says:

@Rafaul: That means that Ophcrack didn’t find a drive that contained a version of Windows on it. If you know that is wrong, you might want to search for and/or post about this issue in the Ophcrack forums.

January 14, 2012 at 8:42 pm
(231) Sean says:

I got Ophcrack to work fine but it couldn’t find the password I needed. I will try another programme and feedback – it may be fast but maybe it isn’t thourough enough!

January 15, 2012 at 12:05 pm
(232) Tim Fisher says:

@Sean: If Ophcrack was much more thorough then it might take several years to crack a password. It’s simply a physical limitation based on how it works. Other programs will clear passwords in seconds, but if you actually want a [free] program to find a password, Ophcrack is your best bet.

January 22, 2012 at 3:53 am
(233) natalie says:

hi , i downloaded ophcrack onto a dvd+r disk with no problems but it wont boot up when i restart my laptop.

February 18, 2012 at 4:20 pm
(234) Tim Fisher says:

@natalie: Sorry for the late reply. My guess is that you computer isn’t configured to look first at the DVD drive for boot data. See How To Boot From a CD, DVD, or BD Disc for help.

February 11, 2012 at 8:55 pm
(235) Jeremy Bartholomew says:

It worked,but couldn’t find the admin. password, it found the others, but i didn’t need those. i have an old laptop hp on windows xp pro. I think i need the full rainbow tables, i used the livecd but it only came with xp small, will the other tables for xp (fast and special) make a difference. I am trying pclogin next.

February 15, 2012 at 1:08 pm
(236) Tim Fisher says:

@Jeremy Bartholomew: They other tables might, but they might not. I don’t think they provide that much more juice when decoding a password but if you have money to spare, go for it. I’d highly recommend that you try PC Login Now (as you’re planning on) and ONTP&RE if that doesn’t work. Granted, they reset, they don’t “discover”, but most of the time that’s just fine.

March 10, 2012 at 11:16 am
(237) Libby says:

I messed it up the first time, but when i tried it again it wouldnt work ? whats wrong ive been stressing all day and night over this! ophcrack wont work twice? ):

March 13, 2012 at 11:41 am
(238) Tim Fisher says:

@Libby: What exactly is (or isn’t) happening?

March 10, 2012 at 2:34 pm
(239) CNute says:

I am trying to recover a password for my business pc and I downloaded on to a cd as instructed but when I turned pc on with cd in drive, a screen popped up and asked for two different things. One a recovery and a debug. It ran the debug and now I have a blue screen with words and numbers scrolling around but it’s been doing this for an hour now. HELP please I have to get in to this thing. :-)

March 13, 2012 at 11:44 am
(240) Tim Fisher says:

@CNute: That’s really strange. I haven’t seen that. Are you sure the disc is being booted to? Do you see any Ophcrack mention? I’m wondering if some other boot-time process is starting instead… what sort of pictures/words do you see other than “recovery” or “debug”?

May 7, 2012 at 2:42 am
(241) patrick says:

hi tim I have done everything correctly to the letter but when linux boots up is says that no partitions with hashes were found is there anything else i can do to fix this?

May 7, 2012 at 10:56 am
(242) Tim Fisher says:

@patrick: Very simply, this means that Ophcrack couldn’t find any drives with Windows on them. Obviously that’s not the case, and there are few reasons it might happen, but regardless, you’re not likely to get it to work. You’ll have to move on to another program.

May 8, 2012 at 6:24 pm
(243) lordmatthias says:

Hey Tim, I’m not sure if you can help but if you could, that would be great. I’ve made it past the Ophcrack boot menu where it boots in graphic mode automatically. Then it starts going through all the code stuff and pauses for a sec at “Sleeping 5 s to let the kernel detect eventual USB devices…” then one more message is displayed which reads “Mounting CDROM: hda on /mnt/hda” and then it just stops there. I’ve waited for several minutes multiple times and it never proceeds. If you have any insight, that would be greatly appreciated. I’m trying to recover some files from an old pc.

May 10, 2012 at 10:55 am
(244) Tim Fisher says:

@lordmatthias: Probably some sort of hardware/driver issue with Linux and your particular computer. You could try again with nonessential hardware removed (scanners, printers, external drives, etc.) or you could just try one of the “reset” tools.

May 8, 2012 at 10:46 pm
(245) victor says:

Tim.
I tried to take your advice from #19 about visiting the forum but I get an error message and cannot reach the forum. My problem is that I received a list of 2 Windows partitions containing hashes and the next line asks me to select which partition to crack. I do not know what to input to complete the process of finding the passwords. Could you please assist me with this problem?

May 10, 2012 at 10:56 am
(246) Tim Fisher says:

@victor: I’m a little confused about what you’re asking. Do you want to know which partition to choose or literally how to choose it (like how to click/select it)?

June 4, 2012 at 5:26 am
(247) Hilde says:

Hello
Sorry for my bad english. But I’ve burned the program to a CD and it works, I can access the password cracking file thing. It comes up, but none of the users come up. It’s just blank. What can I do?

June 5, 2012 at 11:56 am
(248) Tim Fisher says:

@Hilde: This can happen for a few reasons: a) the installation of Linux on the LiveCD doesn’t have a driver for the hard drive controller that the hard drive with Windows on it is connected to b) there’s an issue with your Windows installation that’s preventing the loading of the SAM, and some other less common reasons.

Basically: You’re better off just moving on to one of the “reset” tools I mentioned in the blog post.

June 15, 2012 at 12:15 pm
(249) Skyler says:

Tim,
I’ve followed the instructions you’ve laid out exactly, and I got as far as here: http://pcsupport.about.com/od/toolsofthetrade/ss/ophcracksbs_6.htm

From there, however, it takes me to a sort of orange-ish screen that is not in your directions. I’ve experimented around with it, and managed to pull up the list of usernames… Except the list is blank. Am I doing something wrong?

June 16, 2012 at 1:22 pm
(250) Tim Fisher says:

@Skyler: Sounds to me like an issue between the Linux LiveCD that the Ophcrack team used and your computer. I don’t know that there’s much to do about it without some serious digging around in Linux and some trial and error. And honestly, I’m not up on Linux enough to be of much help there. In cases like this, I send folks to the Ophcrack forums for help or recommend one of the reset (not recovery) programs. Sorry. :(

June 28, 2012 at 9:34 am
(251) CATHY says:

I downloaded Ophcrack and tryed it on my computer but for some reason my cd rom drive does not show up on the list to reset my password on vista, I also tryed booting up with ophcrack but do not see anything you are talking about it just goes to my main screen for me to log in as normal but wont open the ophcrack software.

July 6, 2012 at 4:12 pm
(252) Tim Fisher says:

@CATHY: You must boot to the disc. Did you burn the ISO file properly? Did you change the boot order in BIOS so your motherboard looks at the disc for boot information? It’s all here under the “How To” and the full tutorial here is even more detailed.

August 2, 2012 at 8:23 pm
(253) Lucas McClanahan says:

Tim,

I have correctly downloaded ophcrack, correctly burned it, correctly ordered my cd drive first in bios, but I still am having a problem. The first ophcrack page loads, and when I select “Ophcrack Graphic Mode – automatic” It will start to load. It will load bzinage and rootfs.gz but when it tries to Decompress Linux, it stops and restarts the computer. I have tried it on a Windows 7 64 bit and a Windows Vista 32 bit. Both do the exact same thing. Could you please help?

Thanks,
Lucas

August 13, 2012 at 11:29 am
(254) Tim Fisher says:

@Lucas McClanahan: Sounds like an issue between Linux (specifically, the way it’s setup on the LiveCD) and your computer. I will admit that it seems strange that it happens on two different ones. Are the two computers you tried this on very similar?

August 3, 2012 at 12:26 am
(255) TimR says:

To those who are having the “no tables found” problem:

I found on another site that this issue can be caused by having a 2nd CD or DVD drive in the system. I had this situation. Apparently, the Orphcrack software can get confused by the extra drive and won’t examine the HD properly. I simply turned off my machine, unplugged the 2nd DVD drive, restarted, and it worked fine.

Good luck!

August 13, 2012 at 11:27 am
(256) Tim Fisher says:

@TimR: Thanks for the information! I’ll try to work it in the FAQ somewhere. That’s very, very helpful.

August 19, 2012 at 3:50 pm
(257) Melinda says:

I burned the Ophcrack live cd and it worked perfectly fine, however, it says that the user that I need the password for is *disabled*. I’m not sure why it says that it is disabled or what I need to do to fix it. Thank you.

August 29, 2012 at 11:45 am
(258) Tim Fisher says:

@Melinda: It could mean that there’s a bigger problem with the user account than simply a forgotten password, especially if you’re pretty sure you’re entering the right one and it’s not working. You might try ONTP&RE.

August 25, 2012 at 1:20 am
(259) Mia says:

using ophcrack livecd, booted up computer everything going fine, automatic mode starts, still fine. then all of a sudden stuck at the black screen with the white writing and the green OKs. the last line says sending discover…been waiting a while, have restarted a few times but just keep getting stuck here

August 29, 2012 at 11:45 am
(260) Tim Fisher says:

@Mia: That’s a new one for me. Did you try posting or searching on the official Ophcrack forum?

August 31, 2012 at 10:09 pm
(261) HDJ says:

Ran the live cd and recovered password in matter of minutes in WIN7 Home Premium.Thanks a lot. However I am told that it may not work for passwords with more than 8 characters.

September 4, 2012 at 6:59 am
(262) jozok says:

i ve arrived to the step 8 http://pcsupport.about.com/od/toolsofthetrade/ss/ophcracksbs_8.htm and in the first line of this littlewindow i had
/bin/bash:warning:setlocate.LC_ALL:cannot change locale (en_us).
what should i do.

September 10, 2012 at 11:17 am
(263) Tim Fisher says:

@jazok: That’s not one I’ve seen before. Looks like Ophcrack is trying to automatically change the language settings to wherever you are from English/US but it’s having trouble doing so. Sounds like a good question for the Ophcrack folks over on their forum.

September 30, 2012 at 8:58 pm
(264) Hi says:

Hi Tim,

ive burned ophcrack on a disk and it all works fine except step 8 doesn’t load up, when it gets onto that stage the screen turns to static and i can’t do anything about it. PLEASE HELP ME!!!

October 4, 2012 at 6:56 am
(265) arkman says:

Hi there, I can’t seem to get oph to run from my sandisk usb . I get a screen that reads the following
Syslinux 3.0 2009-05-04 Ebios copyright (c) 1994-2009 H. Peter Anvin et al.

And a blinking cursor.

The gave just sits there until I shut it down. What am I doing wrong?
Thx in advance

October 20, 2012 at 12:58 am
(266) Aaron says:

I am using the ophcrack live cd and what if the password for the user says not found?

at the bottom it says pwd found: 2/4

and a black screen that says:
found partition that contain hashes:
/media/sda3/Windows/System32/config

I don’t know if i’m doing something wrong or right.

November 9, 2012 at 11:11 am
(267) Tim Fisher says:

@Aaron: It doesn’t sound like you’re doing anything wrong. If it doesn’t find it, it means it was too long or complex for ophcrack to “crack.” I’d try one of the reset programs.

October 23, 2012 at 7:08 am
(268) Larry says:

I was having the problem with ‘no tables found’ until I read one of the comments about having multiple cd drives. I have only one cd drive but I have magicjack plugged into one of my usb ports. As soon as I removed magicjack and rebooted everything worked fine.

November 9, 2012 at 11:11 am
(269) Tim Fisher says:

@Larry: Thanks for that comment. Hopefully that’ll help another passerby.

November 21, 2012 at 1:14 pm
(270) Rasse says:

Im having the same issue as Arkman. :(

November 24, 2012 at 3:39 am
(271) cfr says:

Same as Mia (259), stuck on “Sending discover…”
Last white lines before that said “Configuring loopback… [OK], Starting udhcpc client on: eth0…, udhcpc (v1.18.4) started…”
WTF?

November 26, 2012 at 5:45 pm
(272) hanifareed says:

hi guys
this soft really is the best i ever used
but i have got a question: How many times can this cd works for?
i used it for tow or three time and it worked well but after that it is not showing any pass word can you help me and tell me what is the reason
with my best regards

December 11, 2012 at 11:48 am
(273) Tim Fisher says:

@hanifareed: There’s no “limit” to the number of uses. My guess is that this last time where it’s not working for you is due to a password that’s too complex.

December 14, 2012 at 7:28 am
(274) Lily says:

Hey Tim, I recently found your tutorial and did everything it said to, but I’m having a slight issue at one part. I get to the screen with all the text until the end, where it shrinks and hangs there showing me settings or things it did with [ OK ] in green next to it. Nothing happens after that point, and I can’t seem to make it work. Any ideas why?

December 14, 2012 at 11:46 am
(275) Tim Fisher says:

@Lily: It’s probably a driver or other incompatibility. There’s a “best fit” version of Linux on that disc you burned. In other words, it was designed to work with “most” computers. Your best bet is probably another tool.

December 17, 2012 at 2:28 pm
(276) Oberus says:

Hi. (and sory but my eng suck)

I have a litle problem. I use liveCD for vista/7 3.4 and when i tray run graphick mode it just run text mode and cant hack any paswords. it give me only code of paswords and thinking “job is done” but it isn’t. :[

in the past i once use v2.4 and it works.(Fast and do what it shold do) but now… i dont know what i can do. :[

(ophcrack see users and with have pasword or not but can’t hack them)

Again sory for my language :3

December 21, 2012 at 12:55 pm
(277) Tim Fisher says:

@Oberus: Ophcrack’s site should have all the older releases if you think that might work better. Chances are the probably is due to some incompatibility between the generic video card drivers in Linux on the disc and your video card.

December 29, 2012 at 9:29 pm
(278) JP says:

Does not work: Stuck at “sending discover” on Windows XP.

January 5, 2013 at 5:11 am
(279) Salman says:

Tim,
After 0h 10 m 51 s, it pops up with the response not found. What do I do now :) ?

Can you please guide me.

January 17, 2013 at 4:30 pm
(280) Tim Fisher says:

@Salman: If it didn’t find the password, it didn’t find the password. Not much to do there but try one of the other tools.

January 29, 2013 at 12:46 pm
(281) Zorawar Singh says:

Hi Tim!
Thanks for the article!
Apparently i have just a 32GB pen drive on which i have the boot files for both Ophcrack and Linux.
When i boot ophcrack and it starts, i get the message “Tables not found” on the startup. I have made sure that the tables are present in my pen drive.
Is there a way i can manually specify the tables directory?
Thanks in Adance!

January 31, 2013 at 1:00 am
(282) Vince says:

I promised a friend that I woud deliver on a promise I made to retrieve his password wihout knowing how I was gonna do it.I had just one night before meeting up with him and some friends of his he would introduce me to. I searched all night untill I found Ophcrack. Without giving it a test run, I brought it with me the next morning and he brought his labtop with some critical resources lock down by his forgotten password. later in the lunch room he introduce me to a room full of people and handed me the machine – all eyes on ‘ hacker ME’. I slipped in the Ophcrack live CD and crossed my fingers under the table and to my mind blasting surprise – BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM !!!!!!!!!!!
One very BIG moment in my life. Sorry man – I soaked up the moment like it was my own Genius. OPHCRACK is the S#!t !!!!!!!!

February 16, 2013 at 6:36 pm
(283) johnny says:

So I ran OPHcrack on my dell precision 6600. in 4 minutes it returned user name
SophosSAULAPCWELCH0 and a long hexadecimal password. I never was returned to the oph program , only was shown this in dos text mode. Was i supposed to wait longer?

February 21, 2013 at 1:08 pm
(284) Tim Fisher says:

@johnny: No, it sounds like something went wrong. I’d try running it again and see if something different happens. If not, you could head over to the Ophrack forums and ask for some help. Chances are, though, that it’s a problem between your hardware or user account and Ophcrack that isn’t fixable.

February 24, 2013 at 11:20 am
(285) jay says:

Hi there, i hae beengiven a Orphcrack programme as i have forgotten my passwork, ihave put it in the laptop and nothing happens.

What am i ment to do?

I am the only account on the laptop and have no idea what the password is. can somebody please help me.

February 28, 2013 at 12:15 pm
(286) Tim Fisher says:

@jay: If “nothing” happens, check the boot order in BIOS and make sure the optical drive (CD/DVD/BD) is listed first, or at least before the hard drive.

February 28, 2013 at 12:39 am
(287) Caleb M. says:

Great advice my friend recommended this to me. I tried to do the iso on Win 7 using a flash drive method I found elsewhere, but when I boot up from the flash drive it says “Missing operating system”. Am I doing something wrong?

February 28, 2013 at 12:16 pm
(288) Tim Fisher says:

@Caleb M: Take another look at that “flash drive method” – that’s where your problem is. My guess is that the flash drive wasn’t formatted properly before you copied over the Ophcrack files.

March 2, 2013 at 8:15 am
(289) Ephraim says:

Hello, I used the Ophcrack program and got the password off my non- admin users easily, but my admin password has both numbers and alphabets so I loaded Ophcrack with the vista num tables. When it was preloading the Ram for table 3 under vista num I got this error

Problem while preloading table vista num,3 at file 2
Problem while preloading table vista num,3 at file 3

Please help, it would be greatly appreciated

March 5, 2013 at 3:15 pm
(290) Tim Fisher says:

@Ephraim: I’d comment on the official Ophcrack forums if I were you. I’ve only used custom tables once and it worked fine for me. I also don’t get a lot of feedback from folks that use custom tables. The Ophcrack developers should be able to help out.

March 6, 2013 at 6:45 am
(291) Ephraim says:

@Tim Fisher: thanks though

March 22, 2013 at 2:09 am
(292) Steve kash says:

Hi…I admire your work.i followed each and every step until the step where you say a quick window is supposed to appear….my laptop does not get to that step instead its been showing this gray screen for quite a while now…Do I try another software or what do you recommend?

April 9, 2013 at 10:08 am
(293) Tim Fisher says:

@Steve kash: Yea, I’d try something else. Probably some driver incompatibility.

March 22, 2013 at 5:30 am
(294) Steve kash says:

Hi..I greatly admire your work..How long does it take to recover the password because my laptop has been trying for almost 4 hours now?

April 9, 2013 at 10:08 am
(295) Tim Fisher says:

@Steve kash: Hi again Steve. Sorry for the late replies. Are you still talking about Ophcrack? Did you get it to start cracking?

April 6, 2013 at 3:07 am
(296) Rhee says:

I followed your amazing and helpful guides and have successfully launched ophcrack with a CD! Thank you!

But I have one problem. When ophcrack finished cracking, the slot said, “no password found.” I am confused what to do because there IS a password which I don’t remember. Please help, thank you.

April 9, 2013 at 10:10 am
(297) Tim Fisher says:

@Rhee: So for the user in question, Ophcrack says “no password found”? Have you tried logging on with a blank password? (…I know, but it’s worth a shot) If that doesn’t work, I’m assuming Ophcrack goofed. You could try running it again but if that doesn’t work there’s probably not much more to do other than try one of the “reset” tools (#4 above) instead.

April 12, 2013 at 4:34 pm
(298) Richard says:

Do you happen to know if Ophcrack works on Mac and Linux, and if it does, the same way?

April 15, 2013 at 11:15 am
(299) Tim Fisher says:

@Richard: No, Ophcrack is designed to crack Windows logon passwords only. There may be some solutions out there for Mac and/or Linux but I haven’t looked into those so I don’t have any recommendations.

May 24, 2013 at 7:11 pm
(300) Cher says:

OL – sheez so glad it worked for me, thank you thank you thank you. I didn’t think it had worked for me because it was showing ‘x’ in my password slot, and I thought that was some kind of placeholder until it was finished, lol. But realized when I rebooted and ran it again that the x was the password – yay.

May 28, 2013 at 10:53 am
(301) Tim Fisher says:

@Cher: Great!!

May 31, 2013 at 10:20 am
(302) Mark says:

First off, thanks for all the info and advice. I have run Ophcrack LiveCD from boot now and it has been going for over 12 hours. It appears to still be going, but I am unsure if it should take this long. The last entry on the screen is “Configuring Xorg…” and it has been there for a long time. Is it still in the cracking process?

June 17, 2013 at 12:02 pm
(303) Tim Fisher says:

@Mark: No, I don’t think it’s actually doing anything.

June 28, 2013 at 11:47 am
(304) Luke says:

So I ran Ophcrack from boot and its been going for awhile. I’ve seen youtube videos of it and the screen of text takes a couple seconds to go through. But mine stopped at “Sending discover…” There is a blinking line under it like its doing something but its just stopped at that. Is it actually doing something or is it just frozen there?

June 28, 2013 at 11:52 am
(305) Tim Fisher says:

@Luke: Unfortunately, it’s probably just frozen there. Most issues like this with Ophcrack are related to incompatibilities between the generic Linux drivers running on the disc and the hardware in your computer. You could reach out to the Ophcrack folks on their forum or just try one of other programs here.

July 19, 2013 at 5:30 pm
(306) Wanderer says:

I was also stuck on the sending discover command line.
I plugged in a network cable, as another site recommended, and it fixed the problem. Well not sure if the restarting fixed it or plugging in a network cable did.

August 11, 2013 at 7:34 pm
(307) CH says:

I was successful in your tutorital called “How To Recover Passwords Using Ophcrack LiveCD”, up until step 8. After the lines of text that go down, my screen now shows
Welcome to Open Source
Siltaz boot time is: 8s
Welcome to the official Ophcrack LiveCD….
online…
run….

Does this mean it did not find my password or did I do something wrong?

August 16, 2013 at 5:59 am
(308) Mikimoto says:

I have the same problem as CH above “I was successful in your tutorital called “How To Recover Passwords Using Ophcrack LiveCD”, up until step 8. After the lines of text that go down, my screen now shows
Welcome to Open Source
Siltaz boot time is: 8s
Welcome to the official Ophcrack LiveCD running Slitez GNU/Linux
online ophcrack.sourcefurge.net and http://www.slitaz.org
run ‘ophcrack-launcher.sh dialog’ to search again for tables
tax@slita~$
After typing command ‘ophcrack-launcher.sh dialog’ the Ophcrack Launcher menu appeard with options to search for new tables. I tried to type some commands but without succses. So I’m stucked. Any advice Tim?

August 21, 2013 at 6:59 pm
(309) Tim Fisher says:

@Mikimoto @CH: Frankly, it means that it’s just not going to work. It doesn’t even sound like it tried, probably due to a driver or other incompatibility between Linux on the disc and your specific computers. This is common. Your best bet is to try one of the other programs or you could seek some help on the Ophcrack forums.

August 27, 2013 at 8:36 pm
(310) Sparhawk says:

I just loaded ophcrack v3.6.0 live cd onto my a 2gb sandisk cruiser. Download the live cd version you need. The instead of using the tazusb thing they tell you to use use the uniersal usb installer. run the installer and when asked for the iso browse down to the winrar archive file that matches the name of the iso you downloaded. then as the destination put your thumb or whatever usb you are using. once it’s done safely remove the usb and plug into the comp you are trying to get into. worked first time every time. three tries in a row.

September 8, 2013 at 4:30 pm
(311) Carl10 says:

I used ophcrack-vista-livecd-3.6.0.iso and had exact same problem as Mikimoto but after I downloaded and tried ophcrack-notables-livecd-3.6.0.iso and Vista proba free tables it worked.

September 18, 2013 at 1:04 pm
(312) Brett says:

If you run into a problem running the Graphic mode, it is probably because the program ran into “unsupported” Hardware. If this happens, then run the program in “Text” mode to avoid this problem.

September 21, 2013 at 2:24 am
(313) chants says:

afte running this programme in text mode… It runs beautifully. When its finished it shows a a long line of characters and nothing like a password. When i click on view passwords, its just charactes…. Any advise?

October 3, 2013 at 11:28 am
(314) Clyde says:

Hai Tim. I was hoping if you can help me out with my problem. I’m stuck with this satement “Sending Discover”. I waited for a long time but nothing happens.

October 7, 2013 at 12:25 pm
(315) Tim Fisher says:

@Clyde @chants: Looks like an incompatibility. I’d try another program.

October 11, 2013 at 4:15 pm
(316) Mr. Man Sir says:

I have been trying to use ophcrack for 3 hours now without success. I have searched the internet for answer and have found none. I am running Windows 7. The ISO has been burned and re-burned onto a CD, but still doesn’t work. The computer is set to boot up via the CD/DVD player, but it still starts up normally. I went to the Boot Menu and manually selected to run the CD/DVD, but for some reason it just boots normally again. I can’t seem to get it to work for me!

October 31, 2013 at 1:53 pm
(317) Tim Fisher says:

@Mr. Man Sir: Are you burning the ISO file “as an image” using an ISO burner, or are you just burning the whole ISO file to the disc? If you have and are still having trouble, I’d guess there’s an issue with booting that might be solved by clearing CMOS, though it could be something as serious as a bad CD/DVD drive.

October 18, 2013 at 2:14 pm
(318) Bob says:

Just burned the ISO trying to resolve a windows 7 starter password problem. The mini boots from the CD just fine but the ophcrack only runs in text mode. Is there a command to open the gui version?

Bob

October 31, 2013 at 1:53 pm
(319) Tim Fisher says:

@Bob: If Linux on the disc can’t load the graphic driver then it’ll run in text mode. I’m not sure there’s a way to change that if it’s not working out.

April 2, 2014 at 9:38 pm
(320) Scarlet says:

I was able to successfully burn ophcrack to a CD and get it to load on the computer, but the password is coming up as “not found”

My roommate assures me that she would not have picked a long or complicated password. I have been googling about ophcrack and finding something about “tables”

She has windows 7. Are there certain “tables” that need to be downloaded? If so, do I have to burn them onto the CD as well or how does that work?

Leave a Comment

Line and paragraph breaks are automatic. Some HTML allowed: <a href="" title="">, <b>, <i>, <strike>

©2014 About.com. All rights reserved.