Figure 810 shows an Explorer view depicting the location ofthe administratora#39;s NTUSER.DAT hive file. The NTUSER. ... If you look at the five forensically important hive files (SAM, SECURITY, SOFTWARE, SYSTEM, and DEFAULT) located in the %SystemRoot%\System32\config folder, you will note that they have counterparts by the same names located in the %SystemRoot%\repair folder for Windowsanbsp;...
|Title||:||Mastering Windows Network Forensics and Investigation|
|Author||:||Steven Anson, Steve Bunting, Ryan Johnson, Scott Pearson|
|Publisher||:||John Wiley & Sons - 2012-07-30|