How to copy a locked file in Windows

You can copy a locked file from a disk image or hard drive by using the file system browser in OSForensics. In the file system browser choose "Add device to case" from the File menu and select the drive letter or image file you wish to copy from. You can then browse to the file location, right click on the file and use "Save file(s) as..." to save a copy of a file in another location.

The example below shows the live system drive (C) mounted and the SAM registry file being saved to another location, this file is normally locked as it is in use by Windows and can not be copied, deleted or opened. Files permissions that would normally prevent files being accessed are also bypassed when using this method.

Checking MD5 hash of a file


Note: OSForensics version 1.1 or higher required