Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file. Mustang Panda has also used "reg save" on the SYSTEM file Registry location to help extract the NTDS.dit file.