Andrew, > The good guys that wrote Windows Secret Explorer > (LastBit.cm) have included > the date that certain entries were created/added to > keys in the SAM at > least. You may find that bit useful as it can > indicate (clock problems > excepted) when an online form was completed/updated > or access to a login was made.
Thanks, but I've been retrieving the LastWrite times from Registry keys for some time now. I'm looking to go beyond that. Thanks, Harlan ------------------------------------------ Harlan Carvey, CISSP "Windows Forensics and Incident Recovery" http://www.windows-ir.com http://windowsir.blogspot.com ------------------------------------------
