Notifications
Clear all
Topic starter
13/04/2016 5:50 pm
Hello together,
my current case (Windows 7 Home) does have an artifact I've never seen. I usually start with checking SAM and SOFTWARE and noticed just one user-account. But I can see 3 user folders in the USER directory. If I search for the folder names in the current and older SAM I get a hit (parallel search with x-ways forensics) but I can't find it in the SAM. I first thought about a Domain User, but the exhibit obviously wasn't a domain member. I checked the event logs and found the names of the folders as well, for example in the System.evtx (Source Windows Media Player Network, ID14206).
Does someone has a clue about this?
Thank you for your help!