...
Microsoft Windows Vista / 7 Symbolic Link Example | |
|---|---|
C:\Users\All Users\ | C:\ProgramData\ |
Therefore, any software reading the file system will be presented with data from C:\ProgramData\ as if it was contained within C:\Users\All Users\.
...
If a volume is imaged and mounted and presented to the Operating System as Volume G:\, the symbolic link contained within the MFT for G:\Users\All Users\ is is pointing to C:\ProgramData\. If you are using Microsoft Vista or Windows 7/8 as your Operating System, you will have a folder in this location containing your own data. Microsoft Windows will transparently present the data from your volume as if it was contained within G:\Users\All Users\.
| Warning |
|---|
This could have serious |
...
consequences from a forensic point of view if the forensic examiner |
...
inadvertently imports data that does not belong to the case he/she is examining. |