Get the Whitepaper called Active Directory Offline Hash Dump and Forensic Analysis. The author participated in a project where it was required to extract the password hashes from an offline NTDS.DIT file. After searching the Internet for an available tool, the author found that there was no open source tool. Because of that the author decided to research the internals of password encryption and storage of Active Directory and create a tool for the forensic community.
You can download it from the following link: https://packetstormsecurity.com/files/download/107885/offlinehash-analysis.pdf
Source: https://packetstormsecurity.com/files/107885/Active-Directory-Offline-Hash-Dump-And-Forensic-Analysis.html