Notifications
Clear all
Topic starter
08/12/2008 9:23 pm
Does anyone know what would be the most accurate way to find a user's last login from within HKCU (ntuser.dat)? If there's not a key that explicitly states this, I'm assuming there is a record which is always updated upon login, for which the LastWrite could be obtained.
Thanks in advance.
09/12/2008 6:06 am
Its in the SAM hive file…check out RegRipper