User accounts since 10.6 are being managed by OpenDirectory. The backend files related to users for OpenDirectory are here:
ls * in this directory will enumerate all local users registered on the system. Executing
plutil -p <file>.plist will allow you to read some properties for specified user account (i.e. current home directory path).
This is rather undocumented so I accept downvotes. However, this method can be used to inspect a system which is not running, and for which the user has only an offline disk image.