FTK Imager - Copying Protected Registry Files

FTK Imager - Copying Protected Registry Files

January 31, 2017

There is a file in Windows 7 at C:\Users\[username] named NTUSER.DAT.   This is a registry hive.    A new hive is created for each user that logs in.  The hives contain information about a user's application settings, network connections, printers, and environment settings.   This is a very useful file to have when you're imaging a user's laptop or desktop.  However registry files like this one cannot be copied with Windows Explorer.   If you try, you'll get an error message like this one:



FTK Imager can be used to copy this files.    On the toolbar, click on the yellow safe icon.    A new dialog box will appear prompting the user to 'Obtain System Files'.   If you select the option for 'Password recovery and all registry files', and select a folder to copy the files to, the NTUSER.DAT file will be copied with other registry files to the new destination. 




Please reload

Contact Me With Your Litigation Support Questions:


  • Twitter Long Shadow

© 2015 by Sean O'Shea . Proudly created with Wix.com