Collect and verify with RawCopy¶
Read the command before running it¶
Case RC-1042: the case owner needs filesystem metadata from WIN-LAB01 to investigate a missing handover document. Collect $MFT and prepare a traceable collection. A separate parser investigates its records.
Use an elevated Command Prompt and the folders from Install and prepare. This route intentionally reads a live training volume; record the justification and consistency limitations.
RawCopy64.exe /FileNamePath:C:\$MFT /OutputPath:E:\Cases\RC-1042\original /OutputName:WIN-LAB01_MFT.bin
| Part | Meaning | Analyst check |
|---|---|---|
RawCopy64.exe |
Collector in the tool directory | Recorded version and executable hash? |
/FileNamePath:C:\$MFT |
File to extract | Correct host and NTFS volume? |
/OutputPath:...\original |
Destination directory | Separate storage and sufficient space? |
/OutputName:WIN-LAB01_MFT.bin |
Explicit output filename | Unique collection name? |
Quote values containing spaces, for example /OutputPath:"E:\Case Files\RC-1042\original". Always specify the destination; otherwise the documented default is the tool directory.
Other useful options after the basic command works
| Option | Use |
|---|---|
/FileNamePath:C:0 |
Select $MFT by its known record number, 0. Other file record numbers are source specific. |
/WriteFSInfo:1 |
Save volume information in VolInfo.txt; retain it. |
/RawDirMode:2 |
Basic raw directory listing using a path, not an MFT reference. |
/AllAttr:1 |
Extract all attributes; use for a defined need and review all outputs. |
/ImageFile:... /ImageVolume:... |
Select an image and its NTFS volume. |
Check unfamiliar options against the maintainer's reference and examples, then validate with known training data.
1. Collect and retain the log¶
Record start time and time zone. Run this once in a fresh destination; it is the logged version of the command above. Redirection saves normal output and errors, so the console may be quiet while collection runs.
RawCopy64.exe /FileNamePath:C:\$MFT /OutputPath:E:\Cases\RC-1042\original /OutputName:WIN-LAB01_MFT.bin /WriteFSInfo:1 > E:\Cases\RC-1042\notes\rawcopy.txt 2>&1
type E:\Cases\RC-1042\notes\rawcopy.txt
dir E:\Cases\RC-1042\original
Record end time. Inspect the log for errors and the expected file for nonzero size. File existence alone is insufficient. If errors or implausible size appear, retain the failed attempt and retry into a new directory after fixing the cause.
2. Hash and create a working copy¶
certutil -hashfile E:\Cases\RC-1042\original\WIN-LAB01_MFT.bin SHA256 > E:\Cases\RC-1042\notes\original-sha256.txt
copy /b E:\Cases\RC-1042\original\WIN-LAB01_MFT.bin E:\Cases\RC-1042\working\WIN-LAB01_MFT.bin
certutil -hashfile E:\Cases\RC-1042\working\WIN-LAB01_MFT.bin SHA256 > E:\Cases\RC-1042\notes\working-sha256.txt
type E:\Cases\RC-1042\notes\original-sha256.txt
type E:\Cases\RC-1042\notes\working-sha256.txt
Compare the two 64-character digest values, not the whole console output, which includes different paths. If they differ, stop analysis and investigate the copy or storage. Preserve the collected original unchanged under controlled access.
What the hash establishes
Matching hashes support that the working copy matches the collected bytes. Retain both values and verification times.
What the hash cannot establish
It does not prove an unchanged live source, an internally consistent live snapshot, or who performed an action. Repeated live acquisitions can legitimately differ.
3. Hand off for analysis¶
Open the working copy in MFT Explorer or use MFT2CSV. Record parser version, input hash, errors, full path, file reference and relevant timestamps/time zone. Keep parser exports separate from the binary. Correlate before attributing behaviour.
Alternative: collect a registry hive¶
For an authorised configuration investigation, select a different file:
RawCopy64.exe /FileNamePath:C:\Windows\System32\config\SYSTEM /OutputPath:E:\Cases\RC-1042\original /OutputName:WIN-LAB01_SYSTEM
This produces a hive for a registry parser, not a readable report. Plan for relevant transaction logs and live consistency; one copied hive may not answer the whole question.
Alternative: extract from an image¶
This example assumes a verified working raw image whose second volume is confirmed as the intended NTFS volume. Preserve the acquisition hashes and partition map. Do not guess the index or assume an E01 container supports this syntax.
RawCopy64.exe /ImageFile:E:\Images\WIN-LAB01.dd /ImageVolume:2 /FileNamePath:C:0 /OutputPath:E:\Cases\RC-1042\original /OutputName:WIN-LAB01_image_MFT.bin
With an image input, the drive letter in /FileNamePath does not select a live local drive; the image and volume parameters define the source. Hash and document the derived output as above.
Troubleshooting¶
| Symptom | Check and recovery |
|---|---|
| Executable not recognised | Confirm extracted folder and filename; use cd /d when changing drives. |
| Access denied or disk open failure | Confirm elevation, authorised access and source availability. Do not disable security controls to force collection. |
| Source not found | Check NTFS volume, literal path and shell. Unlock encrypted training media through its authorised workflow first. |
| Empty or absent output | Inspect log, volume selection, source support, free space and destination permissions. |
| Hash mismatch | Stop, preserve both values and retry the copy into a fresh destination. |
| Parser rejects output | Verify type, size and hash; inspect collection errors and parser compatibility. Renaming does not change the format. |