His user registry is under his SID in the HKEY_USERS key you just need to identify his SID (looks like S-1-5-220-xxxxx...) or look through them all until you find the key you are looking for (use RegSeeker). You can also use LoadHive to load his registry in an external boot environment like BartPE.
Enjoy.




Reply With Quote
Bookmarks