Deleted user accoun...
 
Notifications
Clear all

Deleted user account

5 Posts
2 Users
0 Likes
706 Views
pronie2121
(@pronie2121)
Posts: 117
Estimable Member
Topic starter
 

I have come across several references in link files that point to a file path of a user that I no longer see on the system. These link files pointed to the C\documents and settings\"USER"\my documents, except when exploring to that area that user folder is no longer there. Is there anyway to see if user accounts have been deleted or registry entries that may track users that have always been on the system? Thanks a lot

 
Posted : 21/10/2008 2:08 am
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

Yes, you may have considerable resources at hand.

However, rather than writing a encyclopedic dissertation, which version of Windows are you working with?

 
Posted : 21/10/2008 3:05 am
pronie2121
(@pronie2121)
Posts: 117
Estimable Member
Topic starter
 

Windows XP

 
Posted : 21/10/2008 5:35 pm
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

If I were you, I'd go into the image and extract all of the SAM hive files from the Restore Points and open them in a Registry Viewer tool…or parse them with RegRipper.

 
Posted : 21/10/2008 11:50 pm
pronie2121
(@pronie2121)
Posts: 117
Estimable Member
Topic starter
 

Thanks for the help keydet

 
Posted : 22/10/2008 12:40 am
Share: