Disk forensics: Wha...
 
Notifications
Clear all

Disk forensics: What domain is a system a member of?

1 Posts
1 Users
0 Likes
434 Views
(@elixirelixir)
Posts: 4
New Member
Topic starter
 

I have acquired a disk image (Win2K8R2/Win7, 32-bit) and would like to know the domain of this system. I have tried the following

Attempt 1 I review Security.evtx and identify the user log on event 4624. I find there is a domain name field in the event log. However, that domain name does not look correct.

Is there any other places I can obtain domain information from the drive?

Thanks in advance!

 
Posted : 27/11/2019 6:21 pm
Share: