Parse Recent RDP sessions from NTUSER.DAT Files
This EnScript was designed as a "quick hit" to parse and show the MRU values for the Terminal server client for each user. The EnScript checks the Software\Microsoft\Terminal Server Client\Default for each NTUSER.DAT and displays/bookmarks any values.
http://www.forensickb.com Customized EnScript development (v6 & v7) available
Version:
1
Tested with:
EnCase Forensic 7.09
EnCase Forensic 7.09
Developer: Lance Mueller
Category: Artifact
1015
Downloads
0
Downloads in last 6 months