Where does the user...
 
Notifications
Clear all

Where does the user folder comes from...

1 Posts
1 Users
0 Reactions
466 Views
(@radiac)
Active Member
Joined: 10 years ago
Posts: 5
Topic starter  

Hello together,
my current case (Windows 7 Home) does have an artifact I've never seen. I usually start with checking SAM and SOFTWARE and noticed just one user-account. But I can see 3 user folders in the USER directory. If I search for the folder names in the current and older SAM I get a hit (parallel search with x-ways forensics) but I can't find it in the SAM. I first thought about a Domain User, but the exhibit obviously wasn't a domain member. I checked the event logs and found the names of the folders as well, for example in the System.evtx (Source Windows Media Player Network, ID14206).

Does someone has a clue about this?

Thank you for your help!


   
Quote
Share: