Subpackages
ese
Package ese implements a read-only parser for Extensible Storage Engine (ESE / JET Blue) database files (EDB), the on-disk format used by Active Directory's NTDS.dit (as well as Windows Search, Exchange, etc.).
Openntds
Package ntds implements the secret-decryption primitives for offline NTDS.dit (Active Directory database) analysis: decrypting the Password Encryption Key (PEK) list with a SYSTEM boot key, and decrypting the per-account hash blobs stored in NTDS attributes (unicodePwd, dBCSPwd, ntPwdHistory, lmPwdHistory, ...).
Open