Results 1 to 3 of 3
  1. #1
    Junior Member
    Join Date
    May 2006

    protected storage

    Programs as Encase with the EDS module and Secret Explorer from Lastbit can read from protected storage on a not-live machine i.e. imported protected storage from another machine (ntuser.dat) to the program. Can anyone explain how this is possible and how they do it?

    tnx in advance

  2. #2
    Master-Jedi-Pimps0r & Moderator thehorse13's Avatar
    Join Date
    Dec 2002
    Washington D.C. area
    Sure, see the Encase white papers on the guidance software site. It explains everything.

    Our scars have the power to remind us that our past was real. -- Hannibal Lecter.
    Talent is God given. Be humble. Fame is man-given. Be grateful. Conceit is self-given. Be careful. -- John Wooden

  3. #3
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    United Kingdom: Bridlington

    I am not quite sure what you are asking.

    1. "Protected Storage" is a Windows 2000/XP concept and is not "that protected" as it happens.
    2. As the file you refer to is on another machine, reading it should be a trivial matter. I would personally consider it to be more "undocumented" than "protected"

    It should not be confused with the "protected areas" that HDD manufacturers use or the "hidden partitions" used by OEMs for their recovery software.

    It is certainly not along the lines of password protecting a laptop HDD which usually encrypts the data as well.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts

We have made updates to our Privacy Policy to reflect the implementation of the General Data Protection Regulation.