Harold is a security analyst who has just run the rdisk /s command to grab the backup SAM file on a computer. Where should Harold navigate on the computer to find the file?

The correct answer is C. %systemroot%\repair. The rdisk /s command (used in Windows NT/2000) forces an update of the emergency repair disk data and saves a backup copy of key system files, including the SAM (Security Account Manager) database, to the %systemroot%\repair directory. This backup SAM can be used to extract…

Submitted by skyler.x· Apr 18, 2026Disk Forensics

Question

Options

A%systemroot%\LSA
B%systemroot%\system32\drivers\etc
C%systemroot%\repair
D%systemroot%\system32\LSA

How the community answered

(41 responses)

A
5% (2)
B
2% (1)
C
90% (37)
D
2% (1)

Explanation

The rdisk /s command (used in Windows NT/2000) forces an update of the emergency repair disk data and saves a backup copy of key system files, including the SAM (Security Account Manager) database, to the %systemroot%\repair directory. This backup SAM can be used to extract password hashes. The %systemroot%\system32\config directory holds the live SAM hive, but the rdisk-generated backup specifically goes to the repair folder.

Topics

#rdisk command#SAM file location#Windows system files#Backup files

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice