RawCopy¶

What RawCopy does¶

NTFS · Targeted evidence collection

RawCopy (by Joakim Schicht) is a utility used to copy locked NTFS system files directly from disk, bypassing Windows file locks.

Your outcome: collect a traceable artefact, verify a working copy, and prepare verified evidence for analysis.

Select
Identify the correct NTFS volume and file needed for the investigation.
Collect
Extract a locked file or filesystem metadata to a separate destination.
Verify
Keep the command, logs, size and SHA-256 with the collected binary.

From locked file to usable evidence¶

Identify the source

Confirm the host, NTFS volume and exact file before collecting. In the lab, WIN-LAB01's C: volume contains the MFT we need.

What you retainCorrect source + recorded scope

Select a stage to explore it. The short animation illustrates the workflow; it does not indicate a running collection.

Interpretation

Collection is not interpretation

RawCopy extracts evidence. It does not build a filesystem timeline or identify an attacker.

Next stepReview a working $MFT copy in MFT Explorer or MFT2CSV.

A filename alone does not establish execution or exfiltration.

Live collection

Live evidence has a time boundary

Live reads can reflect different moments, and collection changes the source system.

Before: justify live collection.
During: record the command, time, source path and destination.
After: hash and preserve the collected file, then create a working copy.

Related files are not an atomic snapshot.

Choose your journey¶

01 · PREPARE

Open the right console

Follow the screenshots, check privileges and prepare the destination.

Start preparing 02 · COLLECT

Build a useful command

Extract an artefact, hash it and troubleshoot failures.

Collect and verify 03 · PRACTISE

Prepare evidence for review

Try the browser terminal, then repeat in an isolated Windows VM.

Open the labs

Choose the right evidence¶

Question	Possible collection	Next step
Which file records are present?	`$MFT`	Parse records; compare paths and file references.
What system configuration needs review?	`Windows\System32\config\SYSTEM`	Use a registry parser; consider transaction logs and consistency.
What filesystem operations need context?	`$LogFile`	Use a compatible parser and correlate other artefacts.

Start small

The beginner route collects one $MFT. RawCopy does not replace disk imaging, memory capture, decryption or a validated recovery workflow.

Quick check: does a matching hash prove a complete investigation?

No. Matching hashes of the collected file and working copy support byte consistency at those checks. They do not prove source completeness, a consistent live snapshot, or who performed an action.

Command options were checked against the maintainer's documentation. The preserved screenshot shows v1.0.0.22; record the version you actually use.