IT Forensics – Windows

Forensic Analysis of Windows User Accounts (SAM) – Evaluating Local Accounts and Security Information

The Security Account Manager (SAM) database is one of the key components of a Windows system. It contains information about local user accounts and other security-related data. As part of an IT forensic investigation, analysing this database can provide important clues regarding existing accounts, group memberships and changes to local user management.

Enquire without obligation

A professional analysis is never carried out in isolation. Only by correlating the data with the Windows Registry, event logs, log-on artefacts, scheduled tasks and other Windows artefacts is it possible to make a robust technical assessment.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

We analyse the SAM database, assess local user accounts, groups and security-related configurations, and cross-check the results against other digital traces. All stages of the investigation are documented in a transparent manner.

Typical areas of application

•Analysis of local user accounts
•Investigation into unauthorised account creation
•Incident Response
•Reconstruction of administrative changes
•Employment law proceedings
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, the relevant system data, including the SAM database, is analysed. The results are correlated with other Windows artefacts and assessed from a technical perspective.

Why is the SAM database important?

The SAM database provides important information about local user accounts and their configuration. However, its full significance only becomes apparent when all relevant digital traces are analysed together.

Frequently Asked Questions

What is the SAM database?+
The Security Account Manager database manages local user and group information in Windows.
Is the original system being examined?+
No. Only a forensic copy or forensic image is analysed.
Can changes to user accounts be traced?+
Depending on the available data, relevant information can be reconstructed from various artefacts.
Is the SAM database alone sufficient for an expert report?+
No. It is always analysed alongside other Windows artefacts.

LanCologne – Windows Forensics in Cologne

Do you need a professional analysis of the Windows SAM database or other Windows artefacts? LanCologne can assist you with the forensically sound preservation of digital evidence and the objective analysis of complex Windows systems.

Get in touch now