However resetting a windows password denies access to EFS encrypted files and DPAPI encrypted data, since the keys for these are encrypted using a KEK derived from the password. In summary: Just write blank password entries into the SAM (which is basically just stored in the registry protected by an ACL so only SYSTEM can access it). I suspect this USB stick just boots to a version of Linux and runs a few scripts. This is trivial, and there are many tools which can do it, such as Trinity Recovery Kit. The password can be reset by booting to another operating system and editing the registry hive.

Resetting a windows password is not equivalent to recovering a windows password. Just curious if anyone knows whats going on behind the curtain. I'm not looking to knock off the product, in fact, I think quite the opposite, its a cool piece of kit and may purchase one for kicks. I'm a security professional and penetration tester by trade, but no administrative windows expert and most of my work is done remotely, so I put this out to the on-site guys and the windows experts. My question is, does anyone know what this could be running to make this happen? Is it rubber ducky-like ( ) or something else?

I know there are software like Katana and the like that can do similar things. Obviously the magic to this piece of hardware is what's contained on it, and if that is true, any usb key could be used to accomplish the same job. This tool requires physical access of course, and there are many things you can do once you have physical access, but this peaked my curiosity.

Hirens boot usb windows 10 password