FTK Windows Server 2008 SYSTEM Filter
I recently found it necessary to quickly grab a large amount of SYSTEM registry files to determine the current control set and time zone information. FTK displays this information upon clicking the SYSTEM registry file. However, when you have a bunch of disk images loaded, it is a pain to navigate to all of them. Below is my filter to grab the SYSTEM file from /Windows/System32/config/. This should work on other OS versions too, but I have not tested yet. It has been working for me on Windows Server 2008 R2 64bit.
<?xml version="1.0" encoding="UTF-8"?> <exportedFilter xmlns="<a href="http://www.accessdata.com/ftk2/filters"><filter">http://www.accessdata.com/ftk2/filters"><filter</a> name="W2K8 System Hive" matchCriterion="all" id="f_1000005" read_only="false" description=""><rule position="0" enabled="true" id="a_9148" operator="is_member"><one_int value="850"/></rule><rule position="1" enabled="true" id="a_9171" operator="contains"><one_string value="/Windows/System32/config/SYSTEM"/></rule></filter><attribute id="a_9148" type="set"><table>ftk_CustomCategories</table><column>CustomCategoryID</column></attribute><attribute id="a_9171" type="string"><table>cmn_ObjectFiles</table><column>Path</column></attribute></exportedFilter>