How to get the password hashes for a user in Mac OS X 10.10+, in recovery/single user mode?

I would like to view the hashes on my Mac, in either single user mode, or the terminal in recovery mode.

I tried to follow the steps described in OS X 10.9: where are password hashes stored. But I do not see my users plist file in the /var/db... folder, but I see root, nobody, daemon, and other .plist files. How can I find these files in recovery/single user mode?

Note: The OS I would be using is either OS X Yosemite or OS X El Capitan; both would be great to know.


Booting to Recovery Mode you will find the users' .plist files in

/Volumes/NameOfMainVolume/var/db/dslocal/nodes/Default/users/...

Don't forget to escape spaces in the name of your main OS X volume with a backslash.

Booting to Single User Mode you have to mount your main volume first:

/sbin/fsck -fy
/sbin/mount -uw /

When booting into recovery mode, the main hard drive is mounted under /Volumes/NameOfMainVolume/ (usually /Volumes/Macintosh\ HD or "/Volumes/Macintosh HD"). So if you need to access files residing on the main drive, include that part into your access path.