Install and prepare RawCopy¶

Accessing RawCopy in SUSA¶

Before you begin: use an authorised Windows training VM, administrator access, an NTFS source, and a separate evidence disk. Examples use C: for the source and E: for evidence. Confirm your own drive letters first.

RawCopy is portable. Running it without arguments displays help; it does not collect evidence or open a graphical interface.

Download and open the tool¶

Open a command prompt and navigate to C:\Tools\JoakimSchichtTools\.

Clone the GitHub repository by running:

git clone https://github.com/jschicht/RawCopy.git

Open a Command Prompt as administrator, navigate to C:\Tools\JoakimSchichtTools\RawCopy and run RawCopy64.exe to verify the installation.

.\RawCopy64.exe

The original screenshots are preserved above. The help screenshot shows v1.0.0.22. Its title identifies an administrator console, and its examples show source and destination parameters. Returning to the prompt after help is expected.

If the tools directory does not exist, create it first. Git is required for the clone method. Alternatively, use Code > Download ZIP in the official repository, then extract it. Adapt the directory if it is named RawCopy-master. Record source URL, download date, executable filename, version and checksum.

Choose the executable

Use RawCopy64.exe on x64 Windows. Change drives and folders with cd /d C:\Tools\JoakimSchichtTools\RawCopy. Confirm the binary matches your environment.

Choose the shell

This learning path uses Command Prompt (cmd.exe). PowerShell can expand $ variables inside double quotes, changing paths such as $MFT. Use Command Prompt for these exercises.

Prepare a case destination¶

Attach a separate writable evidence disk as E: in the training VM. Check its identity and free space. A different drive letter alone does not establish a different physical disk. Use a fresh case directory for each attempt.

mkdir E:\Cases\RC-1042\original
mkdir E:\Cases\RC-1042\working
mkdir E:\Cases\RC-1042\notes
certutil -hashfile RawCopy64.exe SHA256

Save the tool hash and version in your notebook, along with hostname, source volume identity/filesystem, destination identity, operator, purpose and time zone. The folder name original does not itself prevent modification; protect retained evidence through your storage and access controls.

Ready to collect Help opens in an elevated console, the source is NTFS, and the separate case destination is writable.