PASSWORD AND LOG FILE LOCATIONS

Here is a brief list of a few important file locations on different systems.
--------------------
Windows
--------------------
■ Password (Sam) file:
C:\WINDOWS\system32\config\sam
HKEY_LOCAL_MACHINE\SAM
C:\WINDOWS\system32repair\sam

■ System Event Log:
C:\WINDOWS\system32\config\SysEvent.Evt

■ Security Event Log:
C:\WINDOWS\system32\config\SecEvent.Evt

■ Configuration Event Log:
C:\WINDOWS\system32\config\AppEvent.Evt

-----------
UNIX
---------
■ Password file common locations:
/etc/passwd, /etc/shadow, /.secure/etc/passwd, /etc/smbpasswd,
/etc/nis/passwd, /etc/master.passwd, /etc/security/passwd
■ Log files:
/user_account/.bash_history, /var/ (files: utmp, wtmp, messages,
secure, xferlog, maillog, lastlog), /var/log

----------
VNC
------------
■ Windows password storage:
HKEY_USURS\.DEFAULT\SOFTWARE\ORL\WinVNC3\Password

■ UNIX password storage:
$HOME/.vnc/passwd