How to copy a locked file in Windows

You can copy a locked file from a disk image or hard drive by using the file system browser in OSForensics. In the file system browser choose "Add device to case" from the File menu and select the drive letter or image file you wish to copy from. Check the item you wish to copy, right click and scroll to 1 item(s) checked then click ‘Save to disk…’

The example below shows the live system drive (C) mounted and the SAM registry file being saved to another location, this file is normally locked as it is in use by Windows and can not be copied, deleted or opened. Files permissions that would normally prevent files being accessed are also bypassed when using this method.

Note: OSForensics version 1.1 or higher required