2 Responses to Using the SAM hive to profile user accounts

  1. kurt says:

    Hello Mr. Taylor

    I am trying to find out when certain user accounts were both created and deleted on a system running XP. I know that a user account has been made, then deleted and then another made again with the same username. Will either of these methods help me in finding out when the original accounts were created? It was back in 2008, so I’m not sure if it is retained for that long.

    • I haven’t had chance to do any testing on this yet, however the SID of the user accounts are unique, if the account was deleted and a new account created it would have a new SID (regardless of username). If the SAM database can help, it will be a case of figuring out; if when an account is deleted does the SAM delete the corresponding keys? If it does this becomes a bit more challenging, if it doesn’t you should be able to get some dates from the keys themselves (created and last write time are your best bets).

      You may also be able to look elsewhere on the machine for information. The Journal file contains a timeline of when each file/folder was created. However I am not sure how far back that goes. If it does keep everything, you could determine the first time that user logged on by the creation time of the user profile and the time the replacement user logged on by the creation of a new User profile with a similar name (I think XP addded _001 for duplicate user account names, but I might be wrong).

      If the user profile still exists you can get data from there too, the NTUser.dat would contain dates regarding first/last logon with created and last modified dates.

      I hope all of this helps, I will try and have a look tonight (CET) to see if I can replicate this and get you a better answer.

      Cheers, Russ.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s