Hi, By inspection with od -ha etc, I can see much of the format of NTUSER.DAT.
The early part has, in UNICODE, <CR><LF> (sic) delimited lines, it seems. Anyway, a little way through has the line $$$PROTO.HIV and then a little further on are the SIDS, in the format: LEN of this desc 2 bytes Permissions 4 bytes SID in binary format - remaining bytes So, I figure I can write a small utility to print this out. Regards ----- Richard Sharpe, [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED], http://www.richardsharpe.com
