I have come across several references in link files that point to a file path of a user that I no longer see on the system. These link files pointed to the C\documents and settings\"USER"\my documents, except when exploring to that area that user folder is no longer there. Is there anyway to see if user accounts have been deleted or registry entries that may track users that have always been on the system? Thanks a lot
Yes, you may have considerable resources at hand.
However, rather than writing a encyclopedic dissertation, which version of Windows are you working with?
Windows XP
If I were you, I'd go into the image and extract all of the SAM hive files from the Restore Points and open them in a Registry Viewer tool…or parse them with RegRipper.
Thanks for the help keydet