No Desktop or Favor...
 
Notifications
Clear all

No Desktop or Favorites Folder in File Structure

simmonsp21
(@simmonsp21)
New Member

EnCase 7.16
FTK 6.0
Windows 7 System
User Account
Network Logon
https://t.co/HpRC09fiGT

Company laptop has four accounts. This one account does not have a Desktop or Favorites folder in the folder structure when viewing through forensic software EnCase or FTK. How can this occur? The image can be viewed on Twitter.

Thank you,

Quote
Topic starter Posted : 15/01/2019 7:42 pm
athulin
(@athulin)
Community Legend

Company laptop has four accounts. This one account does not have a Desktop or Favorites folder in the folder structure when viewing through forensic software EnCase or FTK. How can this occur?

You know, 'provide as much information as possible …' and all that jazz? It's asked for a reason.

In many situations of this nature, it's a question of not understanding the NTFS access permissions model. It may not be so here, but you have not provided any information to show that you know about it, and have been able to disable it. That would be a good place to start to provide such information.

Who are you? LEO? DFIR analyst? Corporate analyst? Student?

ReplyQuote
Posted : 15/01/2019 8:01 pm
c.wawrentowicz
(@c-wawrentowicz)
Junior Member

Was this laptop in corporate network with Windows servers and active directory ? Active directory has got options redirect folders (desktop, my documents) which can be stored on server disks though for laptops often is using Roaming User Profiles

ReplyQuote
Posted : 15/01/2019 8:24 pm
simmonsp21
(@simmonsp21)
New Member

Thank you. Yes it is on a corporate network and using Roaming User Profiles.

ReplyQuote
Topic starter Posted : 15/01/2019 9:07 pm
c.wawrentowicz
(@c-wawrentowicz)
Junior Member
simmonsp21
(@simmonsp21)
New Member

Thank you, I will read that article. I'll see if I can track down the Network Admin to see if this one account was set up differently than the other 3. I appreciate the response.

ReplyQuote
Topic starter Posted : 15/01/2019 9:25 pm
Share:
Share to...