ForensiT Homepage
Forum Home Forum Home > ForensiT Support > Domain Migration
  New Posts New Posts RSS Feed - Reverting to Domain Profile to Recover Chrome PWs
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

Reverting to Domain Profile to Recover Chrome PWs

 Post Reply Post Reply
Author
Message
bromanbro View Drop Down
Newbie
Newbie


Joined: 03 Mar 2023
Status: Offline
Points: 2
Post Options Post Options   Thanks (0) Thanks(0)   Quote bromanbro Quote  Post ReplyReply Direct Link To This Post Topic: Reverting to Domain Profile to Recover Chrome PWs
    Posted: 03 Mar 2023 at 7:19am
If I run Profwiz to move\revert a user's profile BACK to the original profile (on AD domain), will it use the same SID as before, for recovering lost Chrome passwords? Unfortunately, I didn't backup a user's chrome passwords from their domain profile before migrating it, they didn't sign-in to backup, and although I know their AD password, 3rd party tools can't view the encrypted passwords. Will reverting the profile back (running the profwiz again), allow me to access the lost passwords? Thank you.

I tested in a lab environment which didn't work. Does User Profile Migration delete the encryption keys that programs like Nirsoft's Chromepass use to recover the passwords? When switching back, I think it uses a different SID than before...



Edit 2: Chrome's encryption keys are stored in "Local State", in %localappdata\Google\Chrome\User Data. It replaces the file when the user profile is switched over. In short, is there any way I can have Chrome use the old encryption key? I assume logging into the old profile (having it regenerate) will assign a different SID, so it won't work right? Without Local State, there's no way in I think.


Edited by bromanbro - 04 Mar 2023 at 10:50am
Back to Top
Support View Drop Down
Moderator Group
Moderator Group


Joined: 09 Nov 2006
Location: United Kingdom
Status: Offline
Points: 1860
Post Options Post Options   Thanks (1) Thanks(1)   Quote Support Quote  Post ReplyReply Direct Link To This Post Posted: 13 Mar 2023 at 11:58am
Hi, 

Yes, you can migrate the profile back to the original account and then access / export the Chrome passwords. 

You will need to migrate the profile back to the original user account (that has not been deleted), the original user account will have the same / original SID. 

Thanks,

Support.
Back to Top
CIT0440 View Drop Down
Newbie
Newbie
Avatar

Joined: 24 Feb 2024
Location: Clevelamd
Status: Offline
Points: 1
Post Options Post Options   Thanks (0) Thanks(0)   Quote CIT0440 Quote  Post ReplyReply Direct Link To This Post Posted: 24 Feb 2024 at 1:43am
I migrated from a local Windows user profile to an AD profile and need to revert back to the original to retrieve user Chrome passwords and settings (windows layout). Will reverting back to original account create a new user profile/SID? Thanks in advance.
Back to Top
Support View Drop Down
Moderator Group
Moderator Group


Joined: 09 Nov 2006
Location: United Kingdom
Status: Offline
Points: 1860
Post Options Post Options   Thanks (0) Thanks(0)   Quote Support Quote  Post ReplyReply Direct Link To This Post Posted: 26 Feb 2024 at 1:34pm
No, if you migrate the profile back to the original account, the profile will be associated with the account with the original SID. 

If you have deleted the user account and recreated it, the account will have a new SID.

Many thanks,

Support.
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 12.03
Copyright ©2001-2019 Web Wiz Ltd.

This page was generated in 0.094 seconds.