
UnderlayCopy
PowerShell toolkit that extracts locked Windows files (SAM, SYSTEM, NTDS, ...) using MFT parsing and raw disk reads
data-recoverydigital-forensicsdisk-forensics+3
256

PowerShell toolkit that extracts locked Windows files (SAM, SYSTEM, NTDS, ...) using MFT parsing and raw disk reads

A Mac OS X forensic utility which manages file system mounting in support of forensic procedures.

File carving utility that recovers deleted files from disk images and raw drives by matching headers, footers, and internal structures via…