Why doesn't defaults read` work for obtaining ShadowHashData key in user.plist? I've read how to obtain the user's password hash on OSX using sudo defaults read /var/db/dslocal/nodes/Default/users/user.plist ShadowHashData.

However, after giving Terminal "Full Disk Access" on macOS Mojave, I get the following error:

The domain/default pair of (/var/db/dslocal/nodes/Default/users/user.plist, ShadowHashData) does not exist.


However, the ShadowHashData key can be read by plutil and dscl, so why don't defaults work?

Edit:

dscl (works for obtaining user's hash):

nlykkei-mbp:~ nlykkei$ sudo dscl . -read /Users/nlykkei dsAttrTypeNative:ShadowHashData
dsAttrTypeNative:ShadowHashData:
 62706c69 73743030 d2010203 ...


defaults (doesn't work for obtaining user's hash):

sudo defaults read /var/db/dslocal/nodes/Default/users/nlykkei ShadowHashData
2019-08-07 09:16:32.697 defaults[1123:33825] 
The domain/default pair of (/var/db/dslocal/nodes/Default/users/nlykkei, ShadowHashData) does not exist


whoami (user's identity):

nlykkei-mbp:~ nlykkei$ whoami
nlykkei
nlykkei-mbp:~ nlykkei$ id
uid=501(nlykkei) gid=20(staff) groups=20(staff),502(access_bpf),12(everyone),61(localaccounts),79(_appserverusr),80(admin),81(_appserveradm),98(_lpadmin),33(_appstore),100(_lpoperator),204(_developer),250(_analyticsusers),395(com.apple.access_ftp),398(com.apple.access_screensharing),399(com.apple.access_ssh),701(com.apple.sharepoint.group.1)


uname (OS version):

nlykkei-mbp:~ nlykkei$ uname -a
Darwin nlykkei-mbp 18.6.0 Darwin Kernel Version 18.6.0: Thu Apr 25 23:16:27 PDT 2019; root:xnu-4903.261.4~2/RELEASE_X86_64 x86_64


defaults (works without domain argument):

nlykkei-mbp:~ nlykkei$ sudo defaults read | head -n 10
{
    "Apple Global Domain" =     {
        AKLastIDMSEnvironment = 0;
        AppleKeyboardUIMode = 3;
        "com.apple.sound.beep.flash" = 0;
    };
    bluetoothaudiod =     {
    };
    "com.apple.AppleMultitouchMouse" =     {
        MouseButtonDivision = 55;
 ...
The ‘read’ verb for defaults takes a domain, not a filename, therefore the .plist suffix should be omitted.

sudo defaults read /var/db/dslocal/nodes/Default/users/user ShadowHashData