nikaiw / VMkatz

Extract Windows credentials directly from VM memory snapshots and virtual disks

sailay1996 / HiveOracle

Raw NTFS volume oracle: locked-file read and offline SAM hashes without LSASS