FIGURE A:

Sample Regback.exe Message Sequence

C:\REGBACK>regback 072899.PRE

saving SECURITY to 072899.PRE\SECURITY

saving SOFTWARE to 072899.PRE\software

saving SYSTEM to 072899.PRE\system

saving .DEFAULT to 072899.PRE\default

saving SAM to 072899.PRE\SAM

***Hive = \REGISTRY\USER\S-1-5-21-36516332-637091160-1803697834-1001

Stored in file \Device\Harddisk1\Partition2\WINDOWS\Profiles\Sean\NTUSER.DAT

Must be backed up manually

regback <filename you choose> users S-1-5-21-36516332-637091160-1803697834-1001

C:\REGBACK>regback NTUSER.DAT users S-1-5-21-36516332-637091160-1803697834-1001

saving S-1-5-21-36516332-637091160-1803697834-1001 to NTUSER.DAT