Format of NTUSER.DAT ...
rsharpe at ns.aus.com
Tue Oct 29 08:42:01 GMT 2002
By inspection with od -ha etc, I can see much of the format of NTUSER.DAT.
The early part has, in UNICODE, <CR><LF> (sic) delimited lines, it seems.
Anyway, a little way through has the line $$$PROTO.HIV and then a little
further on are the SIDS, in the format:
LEN of this desc 2 bytes
Permissions 4 bytes
SID in binary format - remaining bytes
So, I figure I can write a small utility to print this out.
Richard Sharpe, rsharpe at ns.aus.com, rsharpe at samba.org,
sharpe at ethereal.com, http://www.richardsharpe.com
More information about the samba-technical