I used Joel's suggestion to reset the password to something known. Having done so I've hashed the drive and did a before and after compare. Only 4 files changed including the user's plist file. This recorded the time and date of the password change as well as a few other differences in hex values.
Sadly, i'm not able to determine which is the before and after hash.
↧