Is there a way to tell by looking whether or not a password hash in the SAM file is LM or NTLM?
I found some info here:
http://www.innovation.ch/java/ntlm.html
and at the bottom of the page I saw this:
lm_hpw (LanManager hashed password):
91 90 16 f6 4e c7 b0 0b a2 35 02 8c a5 0c 7a 03 00 00 00 00 00
nt_hpw (NT hashed password):
8c 1b 59 e3 2e 66 6d ad f1 75 74 5f ad 62 c1 33 00 00 00 00 00
looks like they are the same in length but I was wondering if there were any differences perhaps seen by the trained eye.