Post cover image
Login data

August 14, 2026

🛡️TryHackMe Management Wants a Word Writeup| Forensic Investigation | 2026

Chrome Credential Recovery & VeraCrypt Container Analysis

By Sushma

8 min read

This document walks through the methodology used to extract browser-stored credentials from a forensic disk image and use them to access an encrypted VeraCrypt container discovered on the same system. The steps below reconstruct the analysis performed against a Windows user profile (Vera), covering artifact collection, DPAPI key recovery, Chrome secret decryption, and controlled mounting of the encrypted volume.

📂 Step 1: Navigating the File System

Begin by mounting the forensic image and navigating to the target user's profile. The objective is to locate the Chrome user data directory, which stores both credential and browsing metadata.

  • Path: C:\Users\Vera\AppData\Local\Google\Chrome\User Data\Default
  • Inside this folder, three files are of interest: Login Data, Web Data, and Local State.
└─$ file C/Users/vera/Documents/backup

C/Users/vera/Documents/backup: data

┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ xxd -l 64 C/Users/vera/Documents/backup
00000000: f372 f7cc d607 4b17 a8aa 8865 12af abdf  .r....K....e....
00000010: f293 9a74 72ea acbc bee5 b479 4c88 5c7f  ...tr......yL.\.
00000020: 5f53 fc44 2988 f8fc ae98 21dd c26a 2a9b  _S.D).....!..j*.
00000030: 8c45 8f73 8ac4 1cdc 8377 bb46 9636 4807  .E.s.....w.F.6H.
None 
┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ find C/Users/vera -type f \
  \( -iname 'Login Data' \
  -o -iname 'Local State' \
  -o -iname 'Web Data' \
  -o -iname 'History' \) -print
C/Users/vera/AppData/Local/Google/Chrome For Testing/User Data/Local State
C/Users/vera/AppData/Local/Google/Chrome For Testing/User Data/Default/Login Data
C/Users/vera/AppData/Local/Google/Chrome For Testing/User Data/Default/History
C/Users/vera/AppData/Local/Google/Chrome For Testing/User Data/Default/Web Data

The important files are:

History: browser activity and searches.

Login Data: saved usernames and encrypted passwords.

Web Data: autofill information.

Local State: Chrome's encrypted AES key.

🔍 Step 2: Extracting Chrome Artifacts

With the profile located, use SQLite3 to query the browser's internal databases. These SQLite files retain cached form data, saved search terms, and encrypted login metadata even after the browser is closed.

  • Open the login database:
sqlite3 "path/to/Login Data"

Examine saved browser credentials:

  • Run a query to view stored credential records:
.headers on
.mode column
SELECT * FROM logins;

Note: The password_value column returned here is ciphertext — it is protected by Windows DPAPI and Chrome's own AES layer, so it requires the decryption steps below before it is usable.

┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ sqlite3 C/Users/vera/AppData/Local/Google/Chrome\ For\ Testing/User\ Data/Default/Login\ Data
SQLite version 3.46.1 2024-08-13 09:16:08
Enter ".help" for usage hints.
sqlite> .headers on
sqlite> .mode column
sqlite> SELECT
    origin_url,
    action_url,
    username_value,
    hex(password_value) AS encrypted_password
FROM logins;
origin_url                  action_url                       username_value   encrypted_password
--------------------------  -------------------------------  ---------------  ------------------------------------------------------------
http://bytelotus.thm:8080/  http://bytelotus.thm:8080/login  VeraSecretVault  763130C88A72A64F35F63E883EA0A7F64A6870E46B0BBB469A756EDA88B7
                                                                              E324C3E1C51015AA6FD8D65AC48961E1EA324CE1707807FEB3D7

The autofill database


┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ sqlite3 'C/Users/vera/AppData/Local/Google/Chrome For Testing/User Data/Default/Web Data'
SQLite version 3.46.1 2024-08-13 09:16:08
Enter ".help" for usage hints.
sqlite> SELECT name, value, date_created, date_last_used
FROM autofill
ORDER BY date_last_used DESC;
username|VeraSecretVault|1784501610|1784501610

Locate Vera's DPAPI master key

┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ find C/Users/vera/AppData/Roaming/Microsoft/Protect \
  -type f -printf '%f %p\n'
c90719ef-5b98-474e-b934-136d606a702a C/Users/vera/AppData/Roaming/Microsoft/Protect/S-1-5-21-2529683458-431225740-1723070931-1000/c90719ef-5b98-474e-b934-136d606a702a
Preferred C/Users/vera/AppData/Roaming/Microsoft/Protect/S-1-5-21-2529683458-431225740-1723070931-1000/Preferred
SID:
S-1-5-21-2529683458-431225740-1723070931-1000

Master-key GUID:
c90719ef-5b98-474e-b934-136d606a702a

🔑 Step 3: Decrypting the DPAPI Master Key

Chrome delegates password protection to the Windows Data Protection API (DPAPI). To reverse this, the DPAPI master key tied to the user's profile must be recovered.

  • Master key location: C:\Users\Vera\AppData\Roaming\Microsoft\Protect
  • The master key itself is encrypted with material derived from the user's logon password, so the registry hives must be pulled from the image and processed with Impacket's secretsdump.py to recover the account's password hash / secrets:
secretsdump.py -sam SAM -system SYSTEM -security SECURITY LOCAL

The recovered secrets, combined with the SID for the Vera profile, allow the DPAPI master key blob to be unwrapped offline.

Registry hives:

C/Windows/System32/config/SAM
C/Windows/System32/config/SYSTEM
C/Windows/System32/config/SECURITY
┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ impacket-secretsdump \
  -sam C/Windows/System32/config/SAM \
  -system C/Windows/System32/config/SYSTEM \
  -security C/Windows/System32/config/SECURITY \
  LOCAL
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] Target system bootKey: 0x0f6f73ce89c8cda52d06fcc5131e040f
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:1241186a4aac4f34f4bf7ace71b396a8:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:1961c38510b8e33fcdb1879616d12dfc:::
vera:1000:aad3b435b51404eeaad3b435b51404ee:1241186a4aac4f34f4bf7ace71b396a8:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] DefaultPassword
(Unknown User):minivera
[*] DPAPI_SYSTEM
dpapi_machinekey:0x875427f6426f5dc4e318d1e6cfed17291295e4f7
dpapi_userkey:0xb0536fa518944b2520b5a5b9f5b513e3892224a1
[*] NL$KM
 0000   2F 31 EF E4 6A A6 55 5F  BB 04 9E 1D 72 FD 58 42   /1..j.U_....r.XB
 0010   02 56 65 9D 8D 8E FD 29  56 76 CE 2F 0E 1B 29 62   .Ve....)Vv./..)b
 0020   72 5A 37 BF FC 42 1F A8  58 49 ED 4D A7 85 94 A9   rZ7..B..XI.M....
 0030   3E 23 9A 8B 26 1D 5F AA  8A 09 F8 41 D7 62 92 E3   >#..&._....A.b..
NL$KM:2f31efe46aa6555fbb049e1d72fd58420256659d8d8efd295676ce2f0e1b2962725a37bffc421fa85849ed4da78594a93e239a8b261d5faa8a09f841d76292e3
[*] Cleaning up...
None 
[*] DefaultPassword
(Unknown User):minivera

Decrypt Vera's DPAPI master key

┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ impacket-dpapi masterkey \
  -file 'C/Users/vera/AppData/Roaming/Microsoft/Protect/S-1-5-21-2529683458-431225740-1723070931-1000/c90719ef-5b98-474e-b934-136d606a702a' \
  -sid 'S-1-5-21-2529683458-431225740-1723070931-1000' \
  -password 'minivera'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[MASTERKEYFILE]
Version     :        2 (2)
Guid        : c90719ef-5b98-474e-b934-136d606a702a
Flags       :        5 (5)
Policy      :        0 (0)
MasterKeyLen: 000000b0 (176)
BackupKeyLen: 00000090 (144)
CredHistLen : 00000014 (20)
DomainKeyLen: 00000000 (0)

Decrypted key with User Key (SHA1)
Decrypted key: 0x5e5715ec9b6df5a86e97902692a66d28e691f05d5bc1e04d0159cfe960e94c978c07e5004a0179d3a96df2468885a28175b0b02cc064445f116a752d2b3e9d40
Decrypted key with User Key (SHA1)
Decrypted key: 0x5e5715ec9b6df5a86e97902692a66d28e691f05d5bc1e04d0159cfe960e94c978c07e5004a0179d3a96df2468885a28175b0b02cc064445f116a752d2b3e9d40
┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ MASTERKEY='5e5715ec9b6df5a86e97902692a66d28e691f05d5bc1e04d0159cfe960e94c978c07e5004a0179d3a96df2468885a28175b0b02cc064445f116a752d2b3e9d40'

Extract Chrome's DPAPI-protected AES key

┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ LOCAL_STATE="$(find "$PWD/C/Users/vera" \
  -type f -iname 'Local State' -print -quit)"

┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ echo $LOCAL_STATE
/home/kali/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE/C/Users/vera/AppData/Local/Google/Chrome For Testing/User Data/Local State

└─$ printf '%s\n' "$LOCAL_STATE"

/home/kali/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE/C/Users/vera/AppData/Local/Google/Chrome For Testing/User Data/Local State

🔓 Step 4: Cracking the Chrome Secrets

Once the DPAPI master key is available in plaintext, it can be used to unwrap the AES key Chrome uses internally to encrypt each saved password.

  1. Extract the encrypted key entry from Local State (the value is Base64-encoded; after decoding, strip the leading 5-byte DPAPI prefix).

The os_crypt.encrypted_key value is Base64-encoded and begins with the five-byte string DPAPI.


┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ jq -r '.os_crypt.encrypted_key' "$LOCAL_STATE" |
base64 -d |
xxd
00000000: 4450 4150 4901 0000 00d0 8c9d df01 15d1  DPAPI...........
00000010: 118c 7a00 c04f c297 eb01 0000 00ef 1907  ..z..O..........
00000020: c998 5b4e 47b9 3413 6d60 6a70 2a10 0000  ..[NG.4.m`jp*...
00000030: 0034 0000 0047 006f 006f 0067 006c 0065  .4...G.o.o.g.l.e
00000040: 0020 0043 0068 0072 006f 006d 0065 0020  . .C.h.r.o.m.e.
00000050: 0066 006f 0072 0020 0054 0065 0073 0074  .f.o.r. .T.e.s.t
00000060: 0069 006e 0067 0000 0010 6600 0000 0100  .i.n.g....f.....
00000070: 0020 0000 00e2 df4d d995 89eb fde0 62bc  . .....M......b.
00000080: 08b3 d191 2892 2cfd c5bc 0d7a 39e4 1da7  ....(.,....z9...
00000090: 63c8 da6d 2400 0000 000e 8000 0000 0200  c..m$...........
000000a0: 0020 0000 0041 7cb8 ebaa f6c5 259d 748f  . ...A|.....%.t.
000000b0: 86d3 d525 7d0b c51e c8c3 d5cb 6566 7bd5  ...%}.......ef{.
000000c0: 08bd 7447 d230 0000 00ac 31de 76e4 08ac  ..tG.0....1.v...
000000d0: ae17 3833 d62d 2ff1 b2e0 3265 1a4e 4db7  ..83.-/...2e.NM.
000000e0: 7ced 11f7 964a 7de9 8229 b925 7f7c 24cc  |....J}..).%.|$.
000000f0: 02be 62b4 9a61 9ff0 6740 0000 00a2 3576  ..b..a..g@....5v
00000100: c057 4602 6ef0 4363 1a34 adbf 1484 c917  .WF.n.Cc.4......
00000110: 88c6 a24e 7d79 0a40 da0c bbba effc 941f  ...N}y.@........
00000120: 8d78 4962 5096 96bd 0a0e 1fb5 b3dc e1ae  .xIbP...........
00000130: 024c f00e f857 2799 aa10 fcc9 75         .L...W'.....u

Extract the DPAPI blob while removing the five-byte prefix:

┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ jq -r '.os_crypt.encrypted_key' "$LOCAL_STATE" |
base64 -d |
tail -c +6 > chrome-key.dpapi

2 Feed the decoded blob and the recovered DPAPI master key into a decryption script (e.g. a Python routine using win32crypt/pycryptodome) to unwrap Chrome's internal AES-256 key.

Decrypt Chrome's AES key

┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ python3 - "$MASTERKEY" <<'PY'
import sys
from impacket.dpapi import DPAPI_BLOB

masterkey = bytes.fromhex(sys.argv[1])

with open("chrome-key.dpapi", "rb") as f:
    blob = DPAPI_BLOB(f.read())

decrypted = blob.decrypt(masterkey)

if decrypted is None:
    raise SystemExit("DPAPI decryption failed")

with open("chrome-aes.key", "wb") as f:
    f.write(decrypted)

print(f"Wrote {len(decrypted)} bytes")
print(f"Chrome AES key: {decrypted.hex()}")
PY
Wrote 32 bytes
Chrome AES key: 206a39a0971327ea9487e4aea9844f5d3670162456982276939a712646da0b02

Verify that the result is a 32-byte AES key:

Verify the recovered key length — a correctly unwrapped Chrome v80+ key should be exactly 32 bytes.

┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ wc -c chrome-aes.key
32 chrome-aes.keyDecrypt Chrome’s saved password

This AES key is then applied to each password_value blob pulled from the Login Data database in Step 2 (AES-GCM, stripping the v10/v11 version prefix and 12-byte nonce) to recover the plaintext credentials.

Decrypt Chrome's saved password

┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ LOGIN_DATA="$(find "$PWD/C/Users/vera" \
  -type f -iname 'Login Data' -print -quit)"

┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ printf '%s\n' "$LOGIN_DATA"
/home/kali/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE/C/Users/vera/AppData/Local/Google/Chrome For Testing/User Data/Default/Login Data

┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ file "$LOGIN_DATA"
/home/kali/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE/C/Users/vera/AppData/Local/Google/Chrome For Testing/User Data/Default/Login Data: SQLite 3.x database, last written using SQLite version 3045001, page size 2048, file counter 9, database pages 20, cookie 0xf, schema 4, UTF-8, version-valid-for 9
#Decrypt the v10 credential:
┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ python3 - "$LOGIN_DATA" ./chrome-aes.key <<'PY'
import sqlite3
import sys
from pathlib import Path
from cryptography.hazmat.primitives.ciphers.aead import AESGCM

database = Path(sys.argv[1]).resolve()
keyfile = Path(sys.argv[2]).resolve()

if not database.is_file():
    raise SystemExit(f"Missing database: {database}")

key = keyfile.read_bytes()

if len(key) != 32:
    raise SystemExit(f"Unexpected AES key length: {len(key)}")

db = sqlite3.connect(database.as_uri() + "?mode=ro", uri=True)

for url, username, encrypted in db.execute("""
    SELECT origin_url, username_value, password_value
    FROM logins
"""):
    blob = bytes(encrypted)

    if not blob.startswith((b"v10", b"v11")):
        print(f"Unsupported format: {blob[:10]!r}")
        continue

    nonce = blob[3:15]
    ciphertext_and_tag = blob[15:]

    password = AESGCM(key).decrypt(
        nonce,
        ciphertext_and_tag,
        None
    ).decode("utf-8", errors="replace")

    print(f"URL:      {url}")
    print(f"Username: {username}")
    print(f"Password: {password}")
PY
URL:      http://bytelotus.thm:8080/
Username: VeraSecretVault
Password: Wh4t1sV3raD0inG0nTh1sH0st
Username: VeraSecretVault
Password: Wh4t1sV3raD0inG0nTh1sH0st

Open the VeraCrypt container

🔐 Step 5: Unlocking the VeraCrypt Container

With a plaintext password recovered from the Chrome credential store, the next step is to test it against the encrypted container found elsewhere on the image.

  • Mount the container using the recovered password when prompted:
cryptsetup luksOpen /path/to/backup.tc vera_volume

VeraCrypt itself was not required because Linux cryptsetup supports VeraCrypt containers:

┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ sudo cryptsetup tcryptOpen \
  --veracrypt \
  'C/Users/vera/Documents/backup' \
  vera_backup
[sudo] password for kali:
Enter passphrase for C/Users/vera/Documents/backup:

Mount the decrypted volume read-only:

  • Once unlocked, mount the mapped device read-only to preserve forensic integrity:
mount -o ro /dev/mapper/vera_volume /mnt/v
┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ sudo mkdir -p /mnt/vera

┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ sudo mount -o ro /dev/mapper/vera_backup /mnt/vera

┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ ls /mnt/vera
'$RECYCLE.BIN'   secret_financial_documents  'System Volume Information'

┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ ls /mnt/vera/secret_financial_documents/
important_invoice_byte_lotus.pdf  transactions_q3.csv

Note: Always mount forensic evidence read-only (-o ro) to avoid modifying timestamps or contents of the source data.

🚩 Step 6: Flag Recovery

With the volume mounted, browse the contents of /mnt/v for the target artifact — in this exercise, a financial invoice PDF containing the final flag.

  • Review file listings and metadata for anything named invoice, financial, or similar.
  • Extract the flag value from the document contents once located.
None

Final cleanup — unmount the volume and close the mapped device to leave the environment in a clean state:

umount /mnt/v
cryptsetup luksClose vera_volume
┌──(kali㉿kali)-[~/Downloads/management-wants-a-word-forensics-hh-day-14/KAPE]
└─$ sudo umount /mnt/vera
sudo cryptsetup close vera_backup

Summary

This investigation chained three artifact classes together:(1) browser-stored credentials protected by OS-level DPAPI, (2) registry hive secrets recovered via Impacket, and (3) an encrypted VeraCrypt container whose passphrase had been reused and saved in the browser. The chain highlights a common real-world weakness — password reuse between an OS-level account and sensitive encrypted storage — and demonstrates why credential separation and unique passphrases for encrypted volumes matter.