mft icon indicating copy to clipboard operation
mft copied to clipboard

How to access Windows NTFS MFT?

Open Anutrix opened this issue 1 year ago • 2 comments

I am trying to get a json dump of C:$MFT or D:$MFT files but get:

Error: A runtime error has occurred

Caused by:
    0: Failed to open file D:\$MFT
    1: Access is denied. (os error 5)

I know it's a permission issue not this project's issue but does anyone have any advice?

Anutrix avatar Feb 01 '24 19:02 Anutrix

You can use raw copy to grab the mft (use index 0 for whatever drive you want)

https://github.com/jschicht/RawCopy

lespea avatar Feb 01 '24 19:02 lespea

Just another tool: https://github.com/thewhiteninja/ntfstool.

Thx anyways. I will keep looking.

Anutrix avatar Feb 01 '24 20:02 Anutrix