Mounted Volume and SAM Registry Hive

Aug 25, 2010 at 7:50 AM

I have a mounted disk image, and I am trying to access the SAM registry hive "\Windows\System32\Config\SAM" to pull back some user account information.

RegistryHive reg = new RegistryHive(s);

            RegistryKey k;

            RegistryKey sub = null;

            k = reg.Root.OpenSubKey(@"\SAM\SAM\Domains\Account\User\Names");


The code above is not returning any results... is this possible?

Thanks in advance!

Aug 25, 2010 at 9:07 PM
Edited Aug 25, 2010 at 9:07 PM

I think you have the wrong path - I think you want @"SAM\Domains\Account\Users\Names".

Note - SAM only once, Users with an s and no initial slash.




Aug 26, 2010 at 6:26 AM

Thanks Ken.


You are correct... having the correct key helps. Sorry.