AccessData

Dictionary Utility

User Guide

| 1
AccessData Legal and Contact Information

Document date: February 4, 2014

Legal Information
2014 AccessData Group, Inc. All rights reserved. No part of this publication may be reproduced, photocopied,
stored on a retrieval system, or transmitted without the express written consent of the publisher.
AccessData Group, Inc. makes no representations or warranties with respect to the contents or use of this
documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any
particular purpose. Further, AccessData Group, Inc. reserves the right to revise this publication and to make
changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes.

Further, AccessData Group, Inc. makes no representations or warranties with respect to any software, and
specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.
Further, AccessData Group, Inc. reserves the right to make changes to any and all parts of AccessData
software, at any time, without any obligation to notify any person or entity of such changes.

You may not export or re-export this product in violation of any applicable laws or regulations including, without
limitation, U.S. export regulations or the laws of the country in which you reside.

AccessData Group, Inc.

588 W. 400 S.
Suite 350
Lindon, Utah 84042
U.S.A.
www.accessdata.com

AccessData Trademarks and Copyright Information

AccessData is a registered trademark of AccessData Group, Inc.
AD InSight is a registered trademark of AccessData Group, Inc.
AD Summation is a registered trademark of AccessData Group, Inc.
Distributed Network Attack is a registered trademark of AccessData Group, Inc.
DNA is a registered trademark of AccessData Group, Inc.
Forensic Toolkit is a registered trademark of AccessData Group, Inc.
FTK is a registered trademark of AccessData Group, Inc.
Password Recovery Toolkit is a registered trademark of AccessData Group, Inc.
PRTK is a registered trademark of AccessData Group, Inc.
Registry Viewer is a registered trademark of AccessData Group, Inc.

AccessData Legal and Contact Information | 2

A trademark symbol (, , etc.) denotes an AccessData Group, Inc. trademark. With few exceptions, and
unless otherwise notated, all third-party product names are spelled and capitalized the same way the owner
spells and capitalizes its product name. Third-party trademarks and copyrights are the property of the trademark
and copyright holders. AccessData claims no responsibility for the function or performance of third-party
products.

Third party acknowledgements:

FreeBSD Copyright 1992-2011. The FreeBSD Project .

AFF and AFFLIB Copyright 2005, 2006, 2007, 2008 Simson L. Garfinkel and Basis Technology
Corp. All rights reserved.
Copyright 2005 - 2009 Ayende Rahien
BSD License: Copyright (c) 2009-2011, Andriy Syrov. All rights reserved. Redistribution and use in source and
binary forms, with or without modification, are permitted provided that the following conditions are met:
Redistributions of source code must retain the above copyright notice, this list of conditions and the following
disclaimer; Redistributions in binary form must reproduce the above copyright notice, this list of conditions and
the following disclaimer in the documentation and/or other materials provided with the distribution; Neither the
name of Andriy Syrov nor the names of its contributors may be used to endorse or promote products derived
from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE
COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
WordNet License

This license is available as the file LICENSE in any downloaded version of WordNet.
WordNet 3.0 license: (Download)

WordNet Release 3.0 This software and database is being provided to you, the LICENSEE, by Princeton
University under the following license. By obtaining, using and/or copying this software and database, you agree
that you have read, understood, and will comply with these terms and conditions.: Permission to use, copy,
modify and distribute this software and database and its documentation for any purpose and without fee or
royalty is hereby granted, provided that you agree to comply with the following copyright notice and statements,
including the disclaimer, and that the same appear on ALL copies of the software, database and documentation,
including modifications that you make for internal use or for distribution. WordNet 3.0 Copyright 2006 by
Princeton University. All rights reserved. THIS SOFTWARE AND DATABASE IS PROVIDED "AS IS" AND
PRINCETON UNIVERSITY MAKES NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED. BY
WAY OF EXAMPLE, BUT NOT LIMITATION, PRINCETON UNIVERSITY MAKES NO REPRESENTATIONS OR
WARRANTIES OF MERCHANT- ABILITY OR FITNESS FOR ANY PARTICULAR PURPOSE OR THAT THE
USE OF THE LICENSED SOFTWARE, DATABASE OR DOCUMENTATION WILL NOT INFRINGE ANY THIRD
PARTY PATENTS, COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS. The name of Princeton University or

AccessData Legal and Contact Information | 3

Princeton may not be used in advertising or publicity pertaining to distribution of the software and/or database.
Title to copyright in this software, database and any associated documentation shall at all times remain with
Princeton University and LICENSEE agrees to preserve same.

Documentation Conventions
In AccessData documentation, a number of text variations are used to indicate meanings or actions. For
example, a greater-than symbol (>) is used to separate actions within a step. Where an entry must be typed in
using the keyboard, the variable data is set apart using [variable_data] format. Steps that require the user to
click on a button or icon are indicated by Bolded text. This Italic font indicates a label or non-interactive item in
the user interface.

A trademark symbol (, , etc.) denotes an AccessData Group, Inc. trademark. Unless otherwise notated, all
third-party product names are spelled and capitalized the same way the owner spells and capitalizes its product
name. Third-party trademarks and copyrights are the property of the trademark and copyright holders.
AccessData claims no responsibility for the function or performance of third-party products.

Registration
The AccessData product registration is done at AccessData after a purchase is made, and before the product is
shipped. The licenses are bound to either a USB security device, or a Virtual CmStick, according to your
purchase.

Subscriptions
AccessData provides a one-year licensing subscription with all new product purchases. The subscription allows
you to access technical support, and to download and install the latest releases for your licensed products during
the active license period.

Following the initial licensing period, a subscription renewal is required annually for continued support and for
updating your products. You can renew your subscriptions through your AccessData Sales Representative.

Use License Manager to view your current registration information, to check for product updates and to
download the latest product versions, where they are available for download. You can also visit our web site,
www.accessdata.com anytime to find the latest releases of our products.

For more information, see Managing Licenses in your product manual or on the AccessData website.

AccessData Contact Information

Your AccessData Sales Representative is your main contact with AccessData. Also, listed below are the general
AccessData telephone number and mailing address, and telephone numbers for contacting individual
departments.

AccessData Legal and Contact Information | 4

Mailing Address and General Phone Numbers
You can contact AccessData in the following ways:

AccessData Mailing Address, Hours, and Department Phone Numbers

Corporate Headquarters: AccessData Group, Inc.

588 W. 400 S.
Suite 350
Lindon, UT 84042 USA
Voice: 801.377.5410
Fax: 801.377.5426

General Corporate Hours: Monday through Friday, 8:00 AM 5:00 PM (MST)

AccessData is closed on US Federal Holidays

State and Local Voice: 800.574.5199, option 1

Law Enforcement Sales: Fax: 801.765.4370
Email: Sales@AccessData.com

Federal Sales: Voice: 800.574.5199, option 2

Fax: 801.765.4370
Email: Sales@AccessData.com

Corporate Sales: Voice: 801.377.5410, option 3

Fax: 801.765.4370
Email: Sales@AccessData.com

Training: Voice: 801.377.5410, option 6

Fax: 801.765.4370
Email: Training@AccessData.com

Accounting: Voice: 801.377.5410, option 4

Technical Support
Free technical support is available on all currently licensed AccessData products.
You can contact AccessData Customer and Technical Support in the following ways:

AD SUMMATION Customer & Technical Support Contact Information

AD SUMMATION Americas/Asia-Pacific:
800.786.2778 (North America).
415.659.0105.
Email: support@summation.com

Web Site: http://www.AccessData.com/Support

The Support website allows access to Discussion

Forums, Downloads, Previous Releases, our
Knowledge base, a way to submit and track your
trouble tickets, and in-depth contact information.

Standard Support: Monday through Friday, 6:00 AM 6:00 PM (PST),

except corporate holidays.

After Hours Support: Monday through Friday by calling 415.659.0105.

AccessData Legal and Contact Information | 5

AD SUMMATION Customer & Technical Support Contact Information (Continued)

After Hours Email-only Support: Between 12am and 4am (PST) Product Support is
available only by email at
afterhours@accessdata.com.

AD Customer & Technical Support Contact Information

Domestic Support Americas/Asia-Pacific

Standard Support: Monday through Friday, 5:00 AM 6:00 PM
(MST), except corporate holidays.
Voice: 801.377.5410, option 5
Voice: 800.658.5199 (Toll-free North America)
Email: Support@AccessData.com

After Hours Phone Support: Monday through Friday 6:00 PM to 1:00 AM

(MST), except corporate holidays.
Voice: 801.377.5410, option 5

After Hours Email-only Monday through Friday 1:00 AM to 5:00 AM

Support: (MST), except corporate holidays.
Email: afterhours@accessdata.com

International Support Europe/Middle East/Africa

Standard Support: Monday through Friday, 8:00 AM 5:00 PM (UK-
London), except corporate holidays.
Voice: +44 207 160 2017 (United Kingdom)
Email: emeasupport@accessdata.com

After Hours Support: Monday through Friday, 5:00 PM to 1:00 AM (UK/

London), except corporate holidays.
Voice: 801.377.5410 Option 5*.

After Hours Email-only Support: Monday through Friday, 1:00 AM to 5:00 AM (UK/
London), except corporate holidays.
Email: afterhours@accessdata.com

Other
Web Site: http://www.AccessData.com/Support

The Support web site allows access to Discussion

Forums, Downloads, Previous Releases, our
Knowledgebase, a way to submit and track your
trouble tickets, and in-depth contact information.

Documentation
Please email AccessData regarding any typos, inaccuracies, or other problems you find with the documentation:
documentation@accessdata.com

AccessData Legal and Contact Information | 6

Professional Services
The AccessData Professional Services staff comes with a varied and extensive background in digital
investigations including law enforcement, counter-intelligence, and corporate security. Their collective
experience in working with both government and commercial entities, as well as in providing expert testimony,
enables them to provide a full range of computer forensic and eDiscovery services.

At this time, Professional Services provides support for sales, installation, training, and utilization of FTK, FTK
Pro, Enterprise, eDiscovery, and Lab. They can help you resolve any questions or problems you may have
regarding these products

Contact Information for Professional Services

Contact AccessData Professional Services in the following ways:

AccessData Professional Services Contact Information

Contact Method Number or Address

Phone Washington DC: 410.703.9237

North America: 801.377.5410

North America Toll Free: 800-489-5199, option 7

International: +1.801.377.5410
Email adservices@accessdata.com

AccessData Legal and Contact Information | 7

AccessData Dictionary Utility

Dictionaries are an optimization used for password recovery. By using dictionaries, target-specific candidate
passwords are tested before the more general ones. This utility can be used to create a variety of custom
dictionaries for use with the Password Recovery Toolkit (PRTK) and Distributed Network Attack (DNA).
Important: Make backup copies of word lists and dictionaries before using this utility. Once a dictionary has been
modified or deleted, there may be no way to recover it in its original form.

Dictionary Tools
The following tools can be accessed from the Dictionary Tools menu:

Dictionary Tools and Utilities

Tool or Utility Description
Dictionary Browser Provides a way to view the words in each dictionary, or to
delete a particular dictionary.
Dictionary Provides a way to see the specific details about a dictionary,
Information such as the dictionary type, encoding, language, word
count, and a description.
Biographical Builds a dictionary of candidate passwords from
Dictionary Generator combinations of the biographical data entered.
Pass-phrase Builds dictionaries using sub-phrases from the supplied
Dictionary Generator phrase file.
Permutation Builds dictionaries using permutations of words from the
Dictionary Generator supplied wordlist file.
Standard Dictionary Builds standard dictionaries using the words found in the
Generator supplied word list file.
Merge Golden Merges two golden dictionaries into a single golden
Dictionaries dictionary. It can also merge golden dictionaries from a
PRTK or FTK word list into the current golden dictionary
format.

AccessData Dictionary Utility Dictionary Tools | 8

Starting the Dictionary Utility
The AccessData Dictionary Utility allows you to create and manage the dictionaries of the Password Recovery
Toolkit (PRTK) and Distributed Network Attack (DNA) that are used to help you find passwords.

To start the Dictionary Utility:

1. Start either PRTK or DNA.
2. Click Tools > Dictionary Utility.

Standard Dictionary Generator

To generate a dictionary:
1. Select a tool from the Dictionary Tools menu.
2. Type in or browse to a source file from which to generate the dictionary. This file must be in .TXT format.
3. Click Generate.
If you want to change the defaut generation settings, click More Settings and set your preferences according to
the options described in this guide for each dictionary utility.

The tool generates two dictionaries: one each for Unicode and Codepage encodings. To use these dictionaries,
copy them to the appropriate directory as follows:

PRTK: Program Files\AccessData\PRTK 6\Dictionaries

DNA: Program Files\AccessData\DNA 3\Supervisor\Dictionaries

AccessData Dictionary Utility Starting the Dictionary Utility | 9

Dictionary Browser
The Dictionary Browser provides a way to view the contents of a dictionary, or to delete the dictionary. See all the
dictionaries in the list by dragging the the scroll bar up or down, by clicking or holding the up or down arrow in the
window, or by using the up or down arrows on your keyboard.

AccessData Dictionary Browser

Use the mouse to select a dictionary file from the list of those found in the current directory. Click the drop down
arrow and the up one level button to browse to a different dictionary location.

Let your mouse hover over the windows borders until you see a double-arrow, then drag to expand the display.

Select a dictionary, then click View Entries to see the contents of that dictionary. Close a Dictionary Entries view
before selecting another.

Select a dictionary in the list and click Delete Dictionary to remove a dictionary from the list.

W A R N I N G: This action cannot be undone. Please copy your dictionaries to another folder for backup
purposes before deleting, merging, or making other changes to them.

AccessData Dictionary Utility Starting the Dictionary Utility | 10

Dictionary Information
The Dictionary Information tool provides a way to view details about an AccessData dictionary. The interface is
divided into two different areas: the navigation controls and the details panel.

Dictionary Information

The navigation controls allow you to navigate to the dictionaries that you have stored on your computer.
Selecting a dictionary in the navigator displays the details for that dictionary in the details panel.

The navigator window shows only dictionary files and directories. Each dictionary file entry shows the filename,
type, and the date the file was last modified.

When you select a dictionary, the details pane shows the following information:

Encoding: The encoding of the dictionary. Code page indicates a standard 8-bit character encoding; UTF-16LE
indicates a 16-bit little-endian encoding. Only these encodings are supported at this time.

Language: The language of the dictionary.

Word Count: The number of words that the dictionary contains.

Description: The description of the dictionaries contents.

AccessData Dictionary Utility Starting the Dictionary Utility | 11

Biographical Dictionary Generator
The Biographical Dictionary Generator provides a way to create dictionaries from a collection of biographical
dataany information gathered about a person, such as birthdate, anniversary date, childs name, home
address, favorite city, favorite car, or anything else that pertains to that person.

Biographical Dictionary Generator: Biographical Data Page

To assemble the biographical data into the dictionary, you must complete two tasks:

1. Enter as much personal information about the suspect as you can find into the Biographical Dictionary
Generator.
2. Generate the dictionary.

To add data to a biographical dictionary, do the following:

1. From the Biographical Data tab, select a biographical data category from the dropdown menu. Available
categories are:

Biographical Data Categories

Name Address City
State Zip Code Country
Phone Number Date Number
Word Phrase

2. Type in the specific data for the selected data type, and press Enter, or click Add.
3. You can create a biographical dictionary from a .TXT file, by listing all of the specific data, separating
each name with a carriage return (Enter key).
For example, if you chose the category Name, you would type in a name associated with the person for
which you are compiling the dictionary.
Type in all the names you know for this individual.

AccessData Dictionary Utility Starting the Dictionary Utility | 12

To remove data from the biographical dictionary,
1. Select the data item to remove.
2. Click Remove to delete that data item from the list.
When you are done defining the data to include in the biographical dictionary, click on the Generator
tab, and select your dictionary and word settings. Under the dictionary settings, the language for the
dictionary as well as the type of characters that occur in the dictionary can be specified. By unchecking
one of the character types, that character type will be filtered from the words that are added to the
dictionary when it is generated. See the table below for more information.

Biographical Dictionary Generator Options Page

3. Click Generate. The following character types can be filtered:

Letters
Alphabetic characters used to compose words. These include letters with diacritic marks and any
other type of composed character used to construct words.
Digits
Digit characters for the specific language.
Symbols
Symbol characters. These include punctuation and non-alpha or digit characters but do not include
the diacritic marks used for composed characters.
Diacritics
The special characters used in composed characters.
If Letters are included but Diacritics are not, then the base letter will be preserved.

AccessData Dictionary Utility Starting the Dictionary Utility | 13

Pass-phrase Dictionary Generator
This tool provides a way to create pass-phrase dictionaries. The tool generates all phrases from two words up to
the configuration length specified in the user interface by sliding through the source phrase from start to finish.
Source phrases are provided to the tool in a text file where each phrase is separated from the others by a
carriage return. The user interface for this tool allows you to enter the full path or browse to the source phrase
file. Once a file has been selected the remainder of the controls will become available.

Pass Phrase Dictionary Generator

Under the dictionary settings the language for the dictionary as well as the type of characters that occur in the
dictionary can be specified. By unchecking one of the character types, that character type will be filtered from the
phrases added to the dictionary.

Click Generate.

The following character types can be filtered:

Letters

Alphabetic characters used to compose words. These include letters with diacritic marks and any other
type of composed character used to construct words.
Digits

Digit characters for the selected language.

Symbols

Symbol characters. These include punctuation and non-alpha or digit characters, but do not include the
diacritic marks used for composed characters.

AccessData Dictionary Utility Starting the Dictionary Utility | 14

 Diacritics

The special characters used in composed characters.

If Letters are included but Diacritics are not, then the base letter will be preserved. All generated words
will be truncated to the specified length. You can specify a maximum length of a generated word in
characters if you check Restricting the Length under Word settings.
The phrase composition is the maximum number of consecutive words to use for each generated phrase. If the
requested number of words is more than the total number of words in the source phrase, then the entire source
phrase will be used. If the checkbox to Restrict the Phrase Length is checked, you can specify the maximum
length of the phrase in characters. The generated phrase will be truncated to the specified length regardless of
the resulting number of words that will remain in the generated phrase. You can also import the wordlist to
increase possible combinations.

The tool generates two dictionaries: one each for Unicode and Codepage encodings. To use these dictionaries,
copy them to the following directories:

PRTK: Program Files\AccessData\PRTK 6\Dictionaries

DNA: Program Files\AccessData\DNA 3\Supervisor\Dictionaries

Permutation Dictionary Generator

This tool provides a way to create dictionaries containing the various permutations of a source list of words. You
can enter the full path or browse to the source word list file. Once a file has been selected the remainder of the

AccessData Dictionary Utility Starting the Dictionary Utility | 15

controls will become available. It will generate all possible permutations from a single word to the number of
words specified by the configuration in the user interface.

A source word list is provided in a UTF-8 encoded text file where each word is separated from the others by a
carriage return. You can use a phrase in place of a word since the tool does not try to separate the provided text,
except at carriage returns.

Permutation Dictionary Generator

You can specify the language for the dictionary as well as the type of characters that occur in the dictionary
under the Dictionary Settings. By unchecking one of the character types, that character type will be filtered from
the phrases added to the dictionary.

The following character type can be filtered:

Letters

Alphabetic characters used to compose words. These include letters with diacritic marks and any other
type of composed character used to construct words.
Digits

Digit characters for the specific language.

Symbols

Symbol characters. These include punctuation and non-alpha or digit characters but do not include the
diacritic marks used for composed characters.
Diacritics

The special characters used in composed characters.

If Letters are included but Diacritics are not, then the base letter will be preserved.
Use the following guidelines to help you determine the settings to use for a Permutation Dictionary:

AccessData Dictionary Utility Starting the Dictionary Utility | 16

 You can specify the permutation settings, the number of words to use in each permutation, as well as the
maximum permutation length. By default, the maximum length restriction is disabled.
The permutation composition is the number of words to use in each permutation.
Ifthe requested number of words is more than the total number of words in the source word list then the
entire list will be used.
Ifthe checkbox to Restrict the Length is checked, then you can specify the maximum length of the
permutation in characters.
The permutation will be truncated to the specified length regardless of the resulting number of words that
will remain in the generated permutation.
You can also use the wordlist to increase possible combinations.

Standard Dictionary Generator

This tool provides a way to create standard dictionaries from a source list of words. You can enter the full path or
browse to the source word list file. Once a file has been selected, the remainder of the controls will become
available. A source word list is provided in a UTF-8 encoded text file where each word is separated from the
others by a carriage return. You can use a phrase in place of a word since the tool does not try to separate the
provided text, except at carriage returns.

Standard Dictionary Generator

Under the dictionary settings the language for the dictionary as well as the type of characters that occur in the
dictionary can be specified. By unchecking one of the character types, that character type will be filtered from the
words added to the dictionary.

The following character types can be filtered:

Letters

Alphabetic characters used to compose words. These include letters with diacritic marks and any other
type of composed character used to construct words.
Digits

Digit characters for the specific language.

Symbols

Symbol characters. These include punctuation and non-alpha or digit characters but do not include the
diacritic marks used for composed characters.
Diacritics

The special characters used in composed characters.

If Letters are included but Diacritics are not, then the base letter will be preserved.

AccessData Dictionary Utility Starting the Dictionary Utility | 17

If the checkbox to Restrict the Length is checked, then the maximum length of each word in characters can be
specified. The word will be truncated to the specified length regardless of the resulting number of words that will
remain in the final entry.

For example, if the specified length is 10, and you have three three-letter words, they will not be truncated. You
can also import the wordlist to increase possible combinations.

Merge Golden Dictionaries

This tool provides a way to merge Golden Dictionaries. Two dictionaries are needed in order to perform a merge:
a source and a target. The source dictionary can be any currently supported dictionary format. The target
dictionary must be the current Golden Dictionary format.

Merge Golden Dictionaries

When you click the merge button, the contents of the source dictionary are added into the target dictionary. The
target dictionary will be modified.

W A R N I N G: You cannot undo this operation, so be careful when merging! Please save a copy of the original
files in a separate folder before merging.

AccessData Dictionary Utility Starting the Dictionary Utility | 18