Home Tips & Tricks Copy locked files from a live system with RawCopy

Copy locked files from a live system with RawCopy

0
0
7,265

RawCopy is a console application that copy files off NTFS volumes by using low level disk reading method. Here are some examples:

RawCopy.exe /FileNamePath:C:\pagefile.sys /OutputPath:E:\output – copies the pagefile off a running system.

RawCopy.exe /FileNamePath:C:\WINDOWS\system32\config\SYSTEM /OutputPath:E:\output – copies the SYSTEM hive off a running system.

Download it from GitHub.

Load More Related Articles
Load More In Tips & Tricks
Comments are closed.