Jump to content











Submitter

SUPPORT TOPIC File Information

  • Submitted: May 29 2013 10:11 PM
  • Last Updated: Dec 15 2013 11:14 PM
  • File Size: 3.46MB
  • Views: 8522
  • Downloads: 8927

Previous Versions

  • 29 May 2013 Download RawCopy 1.0.0.5

Download RawCopy 1.0.0.7

* * * * * 3 Votes
filecopy ntfs backup



Screenshots
RawCopy is a file copier for NTFS that uses low level disk reading, and resolves data clusters by parsing the $MFT. It should be able to copy any file off the volume. Even those locked by the system like the registry hives, or the NTFS systemfiles like $MFT and $LogFile etc. It effectively bypass all filesystem security.
  • Source file can be given filepath and filename. Or it can be reference by the IndexNumber (MFT reference number/inode).
  • Output directory must exist.
  • Also there is a an option to also extract all attributes, not just $DATA. This is nice if you want to look at non-resident $Bitmap, $EA, $INDEX_ALLOCATION etc, that may also be fragmented, meaning not many tools will let you extract these.
Usage:
Example copying C:\file.ext to E:\out:


RawCopy C:\file.ext E:\out
Example copying C:\WINDOWS\system32\config\SAM to F:\reg with all attributes including $DATA


RawCopy C:\WINDOWS\system32\config\SAM F:\reg -AllAttr
Example copying IndexNumber 20112 from C: volume to D:\bak only $DATA attribute


RawCopy C:20112 D:\bak

What's New in Version 1.0.0.7 (See full changelog)

  • v1.0.0.7: Fixed bug that caused certain files defined by its name not to be extracted.
  • v1.0.0.6: Fixed bug that produced files with just 00's when using IndexNumber as source file.






  • 375 Total Files
  • 13 Total Categories
  • 90 Total Authors
  • 5097576 Total Downloads
  • Emsisoft Emergency Kit Latest File
  • Rolf Latest Submitter

37 user(s) are online (in the past 3000 minutes)

0 members, 36 guests, 0 anonymous users


Bing (1)