Extracting the NTDS database and SYSTEM hive from a shadow copy