lsass.exeの正しい位置 winlogon.exe | --- lsass.exe --- services.exe | --- Process_A.exe --- Process_B.exe --- Process_B.exe --- Process_B.exe --- Process_B.exe --- Process_B.exe ※「lsass.exe」は一つのみ、複数ある場合はおかしい。 ※「lsass.e…

【旧】 # mount -o loop,ro,show_files,streams_interface=windows,offset=32256 /mnt/hgfs/image.dd /mnt/windows_mount # log2timeline -z Japan -p -r -f winxp /mnt/windows_mount -w supertimeline.txt # l2t_process -b supertimeline.txt > supertime…