Jump to content











Submitter

SUPPORT TOPIC File Information

  • Submitted: May 29 2013 10:11 PM
  • Last Updated: Dec 15 2013 11:14 PM
  • File Size: 3.46MB
  • Views: 14098
  • Downloads: 11550

Previous Versions

  • 29 May 2013 Download RawCopy 1.0.0.5

Download RawCopy 1.0.0.7

* * * * * 3 Votes
filecopy ntfs backup



Screenshots
RawCopy is a file copier for NTFS that uses low level disk reading, and resolves data clusters by parsing the $MFT. It should be able to copy any file off the volume. Even those locked by the system like the registry hives, or the NTFS systemfiles like $MFT and $LogFile etc. It effectively bypass all filesystem security.
  • Source file can be given filepath and filename. Or it can be reference by the IndexNumber (MFT reference number/inode).
  • Output directory must exist.
  • Also there is a an option to also extract all attributes, not just $DATA. This is nice if you want to look at non-resident $Bitmap, $EA, $INDEX_ALLOCATION etc, that may also be fragmented, meaning not many tools will let you extract these.
Usage:
Example copying C:\file.ext to E:\out:


RawCopy C:\file.ext E:\out
Example copying C:\WINDOWS\system32\config\SAM to F:\reg with all attributes including $DATA


RawCopy C:\WINDOWS\system32\config\SAM F:\reg -AllAttr
Example copying IndexNumber 20112 from C: volume to D:\bak only $DATA attribute


RawCopy C:20112 D:\bak

What's New in Version 1.0.0.7 (See full changelog)

  • v1.0.0.7: Fixed bug that caused certain files defined by its name not to be extracted.
  • v1.0.0.6: Fixed bug that produced files with just 00's when using IndexNumber as source file.






  • 430 Total Files
  • 13 Total Categories
  • 92 Total Authors
  • 6808552 Total Downloads
  • Shell Latest File
  • Mahmoud Latest Submitter

147 user(s) are online (in the past 3000 minutes)

0 members, 147 guests, 0 anonymous users