No Desktop or Favor...
 
Notifications
Clear all

No Desktop or Favorites Folder in File Structure

6 Posts
3 Users
0 Reactions
1,203 Views
(@simmonsp21)
New Member
Joined: 7 years ago
Posts: 3
Topic starter  

EnCase 7.16
FTK 6.0
Windows 7 System
User Account
Network Logon
https://t.co/HpRC09fiGT

Company laptop has four accounts. This one account does not have a Desktop or Favorites folder in the folder structure when viewing through forensic software EnCase or FTK. How can this occur? The image can be viewed on Twitter.

Thank you,


   
Quote
(@Anonymous 6593)
Guest
Joined: 17 years ago
Posts: 1158
 

Company laptop has four accounts. This one account does not have a Desktop or Favorites folder in the folder structure when viewing through forensic software EnCase or FTK. How can this occur?

You know, 'provide as much information as possible …' and all that jazz? It's asked for a reason.

In many situations of this nature, it's a question of not understanding the NTFS access permissions model. It may not be so here, but you have not provided any information to show that you know about it, and have been able to disable it. That would be a good place to start to provide such information.

Who are you? LEO? DFIR analyst? Corporate analyst? Student?


   
ReplyQuote
(@c-wawrentowicz)
Eminent Member
Joined: 15 years ago
Posts: 26
 

Was this laptop in corporate network with Windows servers and active directory ? Active directory has got options redirect folders (desktop, my documents) which can be stored on server disks though for laptops often is using Roaming User Profiles


   
ReplyQuote
(@simmonsp21)
New Member
Joined: 7 years ago
Posts: 3
Topic starter  

Thank you. Yes it is on a corporate network and using Roaming User Profiles.


   
ReplyQuote
(@c-wawrentowicz)
Eminent Member
Joined: 15 years ago
Posts: 26
 

look at https://docs.microsoft.com/en-us/windows-server/storage/folder-redirection/folder-redirection-rup-overview


   
ReplyQuote
(@simmonsp21)
New Member
Joined: 7 years ago
Posts: 3
Topic starter  

Thank you, I will read that article. I'll see if I can track down the Network Admin to see if this one account was set up differently than the other 3. I appreciate the response.


   
ReplyQuote
Share: