EnCase 7.16
FTK 6.0
Windows 7 System
User Account
Network Logon
https://t.co/HpRC09fiGT
Company laptop has four accounts. This one account does not have a Desktop or Favorites folder in the folder structure when viewing through forensic software EnCase or FTK. How can this occur? The image can be viewed on Twitter.
Thank you,
Company laptop has four accounts. This one account does not have a Desktop or Favorites folder in the folder structure when viewing through forensic software EnCase or FTK. How can this occur?
You know, 'provide as much information as possible …' and all that jazz? It's asked for a reason.
In many situations of this nature, it's a question of not understanding the NTFS access permissions model. It may not be so here, but you have not provided any information to show that you know about it, and have been able to disable it. That would be a good place to start to provide such information.
Who are you? LEO? DFIR analyst? Corporate analyst? Student?
Was this laptop in corporate network with Windows servers and active directory ? Active directory has got options redirect folders (desktop, my documents) which can be stored on server disks though for laptops often is using Roaming User Profiles
Thank you. Yes it is on a corporate network and using Roaming User Profiles.
look at https://docs.microsoft.com/en-us/windows-server/storage/folder-redirection/folder-redirection-rup-overview
Thank you, I will read that article. I'll see if I can track down the Network Admin to see if this one account was set up differently than the other 3. I appreciate the response.