Mar 152014
 

This is a simple GUI to FSCTL_GET_RETRIEVAL_POINTERS Microsoft API.

The idea is to read all clusters belonging to a file, then map these clusters on the logical drive where this file is located, and from there re assemble all clusters and save them to a new destination file.

Thanks to this method, one can save/copy a file which is in use since we « raw » read clusters from a logical drive.

This has been tested with success on \boot\bcd and \windows\system32\config\sam, files which you cannot copy in a « normal » mode.

Beware that using this method, you could end up with a corrupted dump since the file could be modified while you are reading it.

Download here.

extents

 Posted by at 16 h 15 min

2
Poster un Commentaire

avatar
1 Fils de commentaires
1 Réponses de fil
0 Abonnés
 
Commentaire avec le plus de réactions
Le plus populaire des commentaires
2 Auteurs du commentaire
adminDon Auteurs de commentaires récents
  S’abonner  
plus récent plus ancien
Notifier de
Don
Invité
Don

Dump Extents doesn’t seem to work correctly on my SSD hardware, it either stalls or goes on endlessly.