Using FTK Imager to obtain NTUSER dat and then Registry Viewer for UserAssist registry key analysis

[@notsaab]

Very clear, thank you!

[@Kitzi]

preciate it

[@sulthansk6444]

Thanks for the video...

[@davidabba7663]

hi doc thanks for the video
can i switch to nt user in cmd?how if yes

[@therandomgamerofficial]

Hi, I can't find the user assist folder on my laptop running Windows 10. Why?

[@DrYerby]

Was it in use when acquired? You have to get it while not locked in use.

[@sukunaYT268]

Hi, I cant find a user assist folder. Why?

[@DrYerby]

Make sure that you are using a NTuser.dat file that was not in use when it was acquired. I have not checked this on Windows 11. It may be an issue with the version of the operating system.