...
The above commands create two junction points, both exactly the same as you would find in a typical Windows scenario. Viewing the volume in forensic software show the junctions and their corresponding links.
If you then image the volume and mount the resulting image file on any of the Operating Systems previously identified (and assuming your system drive is C:\
), you will find that accessing the Documents and Settings
folder, or the All Users
folder, will result in the presentation of files and folders from your own file-system.