±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 3 Overall: 35765
New Yesterday: 3 Visitors: 145

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

HELP: Need to Copy locked windows files

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page Previous  1, 2, 3  Next 
  

The-Game
Member
 

Re: HELP: Need to Copy locked windows files

Post Posted: Nov 30, 15 16:58

@jaclaz Thanks alot for the quick response, Well I tried to export the pagefile.sys using FTK Imager and it was able to do it. Hence need to explore how the tool is able to do it and also if there is any alternative open source command line utility to perform the same activity.


Let see if I get a solution for my problem.

Thanks... Smile  
 
  

jaclaz
Senior Member
 

Re: HELP: Need to Copy locked windows files

Post Posted: Nov 30, 15 17:39

- The-Game
Well I tried to export the pagefile.sys using FTK Imager and it was able to do it.

Sure Smile .

The issue is about finding an alternative, additionally an Open Source one.
This might anyway be of interest to you:
blog.opensecurityresea...-from.html

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

erwan.l
Newbie
 

Re: HELP: Need to Copy locked windows files

Post Posted: Nov 30, 15 21:41

Hi Guys,

I am the author of "DumReg" (mentionned in a previous post) to dump online registry hives as well as "Extents" to copy a file in use using windows IOCTL (FSCTL_GET_RETRIEVAL_POINTERS).

Thus when it comes to copy the pagefile it is a whole new game (see some possible ways here).

Thus I'll be happing to follow that discussion and contribute Smile

This is my first post over here so I hope this is ok to point to other forums.

Regards,
Erwan  
 
  

joakims
Senior Member
 

Re: HELP: Need to Copy locked windows files

Post Posted: Dec 01, 15 04:44

The bug in RawCopy has been identified, and a fix implemented. Tool will be updated soon.
_________________
Joakim Schicht

github.com/jschicht 
 
  

The-Game
Member
 

Re: HELP: Need to Copy locked windows files

Post Posted: Dec 01, 15 12:38

@joakims Thanks for the update. Will wait for the patch. Smile  
 
  

jaclaz
Senior Member
 

Re: HELP: Need to Copy locked windows files

Post Posted: Dec 01, 15 15:35

- joakims
The bug in RawCopy has been identified, and a fix implemented. Tool will be updated soon.


Very good Smile and exceptionally fast response Exclamation

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

joakims
Senior Member
 

Re: HELP: Need to Copy locked windows files

Post Posted: Dec 03, 15 00:05

I just uploaded the new version. Please let me know if it worked for you.
_________________
Joakim Schicht

github.com/jschicht 
 

Page 2 of 3
Page Previous  1, 2, 3  Next