Not quite so cut and dry

Orin Kerr gets it partially right:

Most users think of computer searches as occuring at the virtual level, because that's the user experience. But computer forensic software works at the physical level: it treats the hard drive as a physical device that contains millions of zeros and one, not as a virtual "box" of information accessed through an operating system. User profiles and most password protection operate only at a virtual level, so a goverment forensic analyst operating at a physical level wouldn't even notice the difference unless he was specifically looking for it.

It is true that user profiles and passwords only exist as virtual constructs useful to the operating system, but then so do the contents of a file system, which is where that data is stored. Files are another form of virtual construct useful to the operating system, as they are typically implemented as a series of linked blocks of data on the storage device (those blocks are called clusters). The data itself seems to be only a stream of binary data until it is interpretted by software that can understand the file system layout present on that storage volume. So, in that sense, the difference between files and settings such as user profiles is more of a semantic one when you are trying to differentiate between physical storage of data and logical storage of data.