Jump to content


SUPPORT TOPIC File Information

  • Submitted: May 29 2013 10:11 PM
  • Last Updated: Dec 15 2013 11:14 PM
  • File Size: 3.46MB
  • Views: 11969
  • Downloads: 10761

Previous Versions

  • 29 May 2013 Download RawCopy

Download RawCopy

* * * * * 3 Votes
filecopy ntfs backup

RawCopy is a file copier for NTFS that uses low level disk reading, and resolves data clusters by parsing the $MFT. It should be able to copy any file off the volume. Even those locked by the system like the registry hives, or the NTFS systemfiles like $MFT and $LogFile etc. It effectively bypass all filesystem security.
  • Source file can be given filepath and filename. Or it can be reference by the IndexNumber (MFT reference number/inode).
  • Output directory must exist.
  • Also there is a an option to also extract all attributes, not just $DATA. This is nice if you want to look at non-resident $Bitmap, $EA, $INDEX_ALLOCATION etc, that may also be fragmented, meaning not many tools will let you extract these.
Example copying C:\file.ext to E:\out:

RawCopy C:\file.ext E:\out
Example copying C:\WINDOWS\system32\config\SAM to F:\reg with all attributes including $DATA

RawCopy C:\WINDOWS\system32\config\SAM F:\reg -AllAttr
Example copying IndexNumber 20112 from C: volume to D:\bak only $DATA attribute

RawCopy C:20112 D:\bak

What's New in Version (See full changelog)

  • v1.0.0.7: Fixed bug that caused certain files defined by its name not to be extracted.
  • v1.0.0.6: Fixed bug that produced files with just 00's when using IndexNumber as source file.

  • 422 Total Files
  • 13 Total Categories
  • 92 Total Authors
  • 6233578 Total Downloads
  • Wimlib-clc Latest File
  • Tokener Latest Submitter

47 user(s) are online (in the past 3000 minutes)

0 members, 47 guests, 0 anonymous users