You are attempting to access data from the Protected Storage System Provider (PSSP) area of a registry. How do you accomplish this using PRTK?

Question

Options

• AYou drop the SAM file onto the PRTK interface.
• BYou drop the NTUSER.dat file onto the PRTK interface.
• CYou use the PSSP Attack Marshal from Registry Viewer.
• DThis area can not be accessed with PRTK as it is a registry file.

• A
  8% (4)
• B
  76% (38)
• C
  14% (7)
• D
  2% (1)

Explanation

Option B is correct because Protected Storage System Provider (PSSP) data is stored within the user's personal registry hive - NTUSER.dat - under HKCU\Software\Microsoft\Protected Storage System Provider. PRTK (AccessData's Password Recovery Toolkit) is designed to parse and decrypt this hive file directly when you drag and drop it onto its interface, recovering stored credentials like saved passwords and form data.

Option A is wrong because the SAM file is a separate registry hive containing local account password hashes - it has nothing to do with Protected Storage data.

Option C is wrong because "PSSP Attack Marshal" is a fabricated feature that does not exist in Registry Viewer or any AccessData tool.

Option D is wrong because PRTK absolutely can work with registry files - that is a core use case for the tool.

Memory tip: Think "NTUSER = the user's data store." Since PSSP holds user-specific saved passwords and credentials, it lives in the user's hive file (NTUSER.dat), not a system-wide file like SAM.

No community discussion yet for this question.