Taking Ownership of a Folder or Strip Permissions
Hello Forensic Focus Members,
I was hoping you can assist me. I am curious if there is a way to bypass the
"you don't currently have permission to access this folder" message when trying to access files from an image using FTK imager.
Is there anyway to bypass this (maybe using a different mounting tool?) without the need to extract the file from the image to your computer and take ownership.
If there is no way to accomplish this without extracting the files…is there a program (possibly free) that will extract the data within the image and automatically take ownership of any secured folders without the need for user interaction.
Thank you for your assistance.
Are you running Imager as Administrator?
Are you looking at a physical drive or a forensic image of a drive? Or are you mounting a forensic image and browsing the mounted drive?
If you are mounting a forensic image (which seems to be what you indicate in your post), Imager creates in essence a delta file and you can safely take ownership without impacting the forensic image.
That said, I would open the forensic image and browse it in Imager rather than mounting the drive and browsing it in file explorer.
I originally tried mounting the image and viewing the files in Windows explorer.
I did notice that when you choose the option to "extract the files" when you add the forensic image as an evidence item it will bypass the ownership.
The problem I have is sometimes when exporting the data I run into long file path issues. Generally we use a program like safecopy or XXcopy that can bypass the long file path issues.
If the only way to accomplish this is by adding a forensic image as an evidence item, how do you bypass the Windows file path character limits?