FTK Imager - Copying Protected Registry Files

There is a file in Windows 7 at C:\Users\[username] named NTUSER.DAT. This is a registry hive. A new hive is created for each user that logs in. The hives contain information about a user's application settings, network connections, printers, and environment settings. This is a very useful file to have when you're imaging a user's laptop or desktop. However registry files like this one cannot be copied with Windows Explorer. If you try, you'll get an error message like this one:

FTK Imager can be used to copy this files. On the toolbar, click on the yellow safe icon. A new dialog box will appear prompting the user to 'Obtain System Files'. If you select the option for 'Password recovery and all registry files', and select a folder to copy the files to, the NTUSER.DAT file will be copied with other registry files to the new destination.

Prefetch Files

In Windows 8, you can find prefetch files at C:\Windows\Prefetch . These files have the extension .pf. The files are used by Windows to help applications start up faster. Metadata in the files tracks how often applications are used, when they are used, and which files the applications utilize.

Nirsoft has another great utility which allows you to view the content for these files. It's available for download here. WinPrefetchView will automatically find your prefetch files and automatically index their metadata.

As you can see this utility gives you a list of how many times an application has been used, and when it was last used in the columns to the right.

Shadow Explorer

The Tip of the Night for October 8, 2015 discussed Volume Snapshot copies in Windows. Windows will automatically make copies of data on users' hard drives. Shadow Explorer is an application which allows you to access different shadow copies from a drop down menu, and export individual back-up folders that you want to export (just right click).

It is particularly useful for Windows 8 users who don't have a GUI interface to access the shadow copies their operating systems generate.