Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

The above commands create two junction points, both exactly the same as you would find in a typical Windows scenario. Viewing the volume in forensic software show the junctions and their corresponding links.

 

 

 If you then image the volume and mount the resulting image file on any of the Operating Systems previously identified (and assuming your system drive is C:\), you will find that accessing the Documents and Settings folder, or the All Users folder, will result in the presentation of files and folders from your own file-system.

References