Actually, the Win98 registry editor does not have a straight forward means for letting one view the registry files (system.dat, User.dat, classes.dat) from other Win 9x/Me machines. (You can use regidt32 in NT to view other NT registries.) I would suggest a small little program called regdat, available at http://people.freenet.de/h.ulbrich/. >-----Original Message----- >From: Seth Arnold [mailto:sarnoldat_private] >Sent: Wednesday, April 24, 2002 9:55 AM >To: forensicsat_private >Subject: Re: Desktop files enumerated in windows user.dat? >On Tue, Apr 23, 2002 at 04:08:15PM -0400, Burnette, Michael wrote: >> Is anyone aware of what the file listing at the end of a Windows 98 >> User.dat is? When I open the file with a text editor I see the >> following (binary removed): >If I am not mistaken, the Win98 registry editor can view registry files from other machines. (Work on a copy. :) Using the registry editor, you >could see _where_ in the registry these files were referenced, and that might be more useful to you. ----------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Thu Apr 25 2002 - 21:25:41 PDT