After running rdisk /s to grab the backup SAM file, where should you navigate on the system to find the file?

• A. %systemroot%\system32\drivers\etc
• B. %systemroot%\repair
• C. %systemroot%\LSA
• D. %systemroot%\system32\LSA

Answer: (B)

The SAM file is a registry hive that Windows stores with security data, but it’s locked while the system is running. Forensic access is typically done from an offline or recovery state, where Windows provides a backup copy of registry hives in a special repair area. That Repair folder (under the Windows install directory) is where the backup SAM is kept, so you’d look there to grab the copy you need. Therefore, the correct location is %systemroot%\repair. The other locations hold unrelated system files (for example, the etc folder contains hosts files, and the LSA-related folders are not the SAM backup location), so they wouldn’t contain the backup you’re after.