[forensic] NTDS.DIT Forensics

http://www.ntdsxtract.com/downloads/ntdsxtract/ntds_forensics.pdf
screenshot