Step 1
Step 2
C:\Users\Default>dir /ah
Volume in drive C has no label.
Volume Serial Number is C8FB-759A
Directory of C:\Users\Default
17.05.2021 09:32 <DIR> .
17.05.2021 09:32 <DIR> ..
15.09.2018 09:19 <DIR> AppData
17.05.2021 09:32 <JUNCTION> Application Data [C:\Users\Default\AppData\Roaming]
17.05.2021 09:32 <JUNCTION> Cookies [C:\Users\Default\AppData\Local\Microsoft\Windows\INetCookies]
17.05.2021 09:32 <JUNCTION> Local Settings [C:\Users\Default\AppData\Local]
17.05.2021 09:32 <JUNCTION> My Documents [C:\Users\Default\Documents]
17.05.2021 09:32 <JUNCTION> NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
15.09.2018 08:09 65.536 NTUSER.DAT.LOG1
15.09.2018 08:09 0 NTUSER.DAT.LOG2
17.05.2021 09:32 65.536 NTUSER.DAT{1c3790b4-b8ad-11e8-aa21-e41d2d101530}.TM.blf
17.05.2021 09:32 524.288 NTUSER.DAT{1c3790b4-b8ad-11e8-aa21-e41d2d101530}.TMContainer00000000000000000001.regtrans-ms
17.05.2021 09:32 524.288 NTUSER.DAT{1c3790b4-b8ad-11e8-aa21-e41d2d101530}.TMContainer00000000000000000002.regtrans-ms
17.05.2021 09:32 <JUNCTION> PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
17.05.2021 09:32 <JUNCTION> Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent]
17.05.2021 09:32 <JUNCTION> SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo]
17.05.2021 09:32 <JUNCTION> Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu]
17.05.2021 09:32 <JUNCTION> Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates]
5 File(s) 1.179.648 bytes
13 Dir(s) 18.715.426.816 bytes free