01-02-2022, 01:38 PM
I have a couple of remarks:
First, in (3.) you explain that the Windows-partition is sda3, but in (4.) you type - apparently - sdb3. Please check if this is a typo.
Second, you need to skip 31744 bytes from the beginning of the disk (sda in your case), not from the partition (sda3).
Third, did you look at https://hashcat.net/wiki/doku.php?id=example_hashes in order to determine what mode you need to use? When looking at the right spot, you see that for the default-VC-boot it is mode 13761.
Finally, why not using the latest Hashcat v6.2.5, as found on https://hashcat.net/hashcat/, in place of the one-and-a-half-year-old-6.0.0?
Happy cracking !
First, in (3.) you explain that the Windows-partition is sda3, but in (4.) you type - apparently - sdb3. Please check if this is a typo.
Second, you need to skip 31744 bytes from the beginning of the disk (sda in your case), not from the partition (sda3).
Third, did you look at https://hashcat.net/wiki/doku.php?id=example_hashes in order to determine what mode you need to use? When looking at the right spot, you see that for the default-VC-boot it is mode 13761.
Finally, why not using the latest Hashcat v6.2.5, as found on https://hashcat.net/hashcat/, in place of the one-and-a-half-year-old-6.0.0?
Happy cracking !