Sign in to follow this  
Followers 0
joakim

RawCopy - low level file copying (extraction)

3 posts in this topic

Here is a low level file copy console application. It works by reading directly from the physical disk and interpreting the Master File Table. It is NTFS only supported. Copying files from a volume this way takes, to no surprise, longer than by regular file copying. The advantage is to be able to copy files that otherwise are locked for some reason. That means as long as a given file has its own $MFT record number (index number), and its sectors are not overwritten, then you can extract the file.

For a demo, try to copy the SYSTEM hive from your running system. Normally it is locked.

The download along with the rest of the NTFS utilities can be found here: http://code.google.com/p/mft2csv/downloads/list

More documentation can be found in the wiki section on the same link.

Share this post


Link to post
Share on other sites



#2 ·  Posted (edited)

Who knew accessing the MFT was possible in AutoIt??

Bumping so maybe someone with more experience will find use out of it

Edited by money

Share this post


Link to post
Share on other sites

Well, thanks for bumping. Looks way over my head, but I bet I can get some practical use out of RawCopy.


[center]Spiderskank Spiderskank[/center]GetOpt Parse command line options UDF | AU3Text Program internationalization UDF | Identicon visual hash UDF

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0