Hello.
I'm new to the Forensic Focus, but I like the idea. It helped me a lot in finding a lot new software that will make my work a lot easier and faster.
Anyway, now i have this nasty problem
Is there any way to determine the full name of Windows XP (and any other windows for that matter) of an user account, without booting the drive or the immage.
I know that if I start the computer with the welcome screen the name shown will be the full name, but what logging without the welcome screen you have to writhe the username instead of the full name.
This will help me a lot.
Nicci
You could extract the registry files from the image and run them through RegRipper. Take a look at the SAM file and it should tell you about the users.
KP
Thanks - that worked really nice.
Nicci
P.S.
Sorry for the late answer and the bump that will occure, but I was in the court room yesturday.
No worries on the late reply. Glad it worked out for you. )
KP