Notifications
Clear all
Topic starter
24/02/2009 3:09 pm
I have some useful search hits in the following files
hosts.DATE.backup
_REGISTRY_USER_NTUSER_S_1_5_18
_REGISTRY_USER_.DEFAULT
The latter two are from a system restore (XP) so any help with getting at this in a useful way would be appreciated
24/02/2009 3:14 pm
From what you posted, the first is probably a backup of the hosts file, so probably IP -> DNS lists, be wary as your 'interesting' matches could turn out to be part of a blocklist etc.
The latter two would appear to be registry backups, so deal with them in the same way you would an ntuser.dat etc
Rich
Topic starter
24/02/2009 3:18 pm
Nice one thanks