Notifications
Clear all
General (Technical, Procedural, Software, Hardware etc.)
1
Posts
1
Users
0
Reactions
830
Views
Topic starter
27/11/2019 7:21 pm
I have acquired a disk image (Win2K8R2/Win7, 32-bit) and would like to know the domain of this system. I have tried the following
Attempt 1 I review Security.evtx and identify the user log on event 4624. I find there is a domain name field in the event log. However, that domain name does not look correct.
Is there any other places I can obtain domain information from the drive?
Thanks in advance!