AUTOEXEC.NT - used to initialize the MS-DOS environment. Not registry oriented.
gotcha! this is a 16-bit environment and does not understand long file names. Any file name used must conform to the 8.3 naming convention.
CONFIG.NT - used to initialize the MS-DOS environment. Not registry oriented.
DEFAULT._ - contains the HKEY_USERS\.Default hive. Default user settings.
NTUSER.DA_ - new user profile, NT 4.x file.
SAM._ - copy of HKEY_LOCAL_MACHINE\SAM hive. Contains user and domain account and password data.
SECURITY - copy of HKEY_LOCAL_MACHINE\Security hive. Contains local security and user right data. SAM is a subkey of SECURITY.
SETUP.LOG - contains setup/configuration information used in repairs.
software._ - copy of HKEY_LOCAL_MACHINE\Software hive. Subkeys for each installed product.
system._ - copy of HKEY_LOCAL_MACHINE\System hive. Contains system start-up, device drivers, services, ...
Are the ERD contents same as the repair directory (\winnt\repair)? YES. Only real difference is that you can have many copies of the ERD and there is only one repair directory. [excluding situation where server has so many accounts, that SAM is too large for a floppy disk]
Note: Files with the ._ extension are compressed. System._, Software._, Security._, SAM._, Default._ and NTUSER.DA_ can all be uncompressed using EXPAND.EXE.
