Windows NTUSER.DAT Drive Letter Mappings
This is a simple script that extracts the drive-letter mappings from HKCU\Network.
The script will process specified NTUSER.DAT files from the current case.
Output is by way of bookmarks and a tab-delimited spreadsheet file openable in Microsoft Excel.
This script was developed for use in EnCase training. For more details, please click the following link:Download Now