← All tools

UnderlayCopy

https://github.com/kfallahi/UnderlayCopy

Free

Categories

Exploitation

Description

PowerShell toolkit that extracts locked Windows files (SAM, SYSTEM, NTDS, ...) using MFT parsing and raw disk reads

Keywords

dfir ntfs red-team powershell

Example Usage

.\UnderlayCopy.ps1
   Underlay-Copy -Mode MFT -SourceFile C:\Windows\System32\config\SAM -DestinationFile C:\Windows\Temp\sam.dmp
   Underlay-Copy -Mode MFT -SourceFile C:\Windows\NTDS\ntds.dit -DestinationFile C:\Windows\Temp\ntds.dmp
   Underlay-Copy -Mode Metadata -SourceFile C:\Windows\NTDS\ntds.dit -DestinationFile C:\Windows\Temp\ntds.dmp