In below case we are using Kali Linux OS to mount the windows partition over it. Once the file is copied we will decrypt the SAM file with SYSKEY and get the hashes for breaking the password.
Windows does not allow users to copy the SAM file in another location so you have to use another OS to mount windows over it and copy the SAM file. During the boot time the hashes from the SAM file gets decrypted using SYSKEY and hashes is loaded in registry which is then used for authentication purpose, according to ethical hacking courses.
In windows, password is typically stored in SAM file in %SystemRoot%\system32\config. Windows uses the NTLM hash.
