Filenames will be appended (unless none of their clusters appear to have been reallocated, in which case they will remain as is) to identify what percentage of their clusters have apparently not been reallocated. Deleted files which have not been completely overwritten will be displayed in the folder at the root of each volume.The streams currently exposed are $OBJECT ID, $INDEXROOT, $INDEX ALLOCATION, $EA, and $LOGGEDUTILITY_STREAM. You can also find concatenated stream data for the entire volume at the root of the folder, using the naming convention. You will find the entire volume's folder structure replicated here, and within each folder you will find the associated streams using the naming convention (STREAMNAME).(STREAMTYPE). NTFS streams in the folder at the root of each volume.NTFS Alternate Data Streams (ADS) as files suffixed with their stream names alongside the 'normal' files they are associated with.NTFS metafiles (for example, $MFT, $LogFile, $UsnJrnl.$J).Save disk images with fully-decrypted BitLocker volumes Windows file system driver bypass (FAT, NTFS, ExFAT, HFS+, Ext2/3/4, etc.)Įxposure of NTFS metadata, slack, and unallocated in Windows file system driver bypass mode Write mounted disk images to physical disks with optional free space clearing Launch virtual machines directly from Volume Shadow CopiesĪttach to actual physical disks (fixed and removable) to leverage virtual machine launching, VSC mounting, etc. Volume Shadow Copy mounting (standard, with Windows NTFS driver bypass, or as complete disks) Professional Mode offers all Free Mode functionality plus:Įffortlessly launch virtual machines from disk imagesĮxtremely powerful Windows authentication and DPAPI bypasses within virtual machines MBR injection, fake disk signatures, removable disk emulation, and much more RAM disk creation with either static or dynamic memory allocation Identify (with details), unlock, fully decrypt, and disable/suspend BitLocker-protected volumesĪccess disks, volumes, and Volume Shadow Copies as virtual dd files Save 'physically' mounted objects to various disk image formats Temporary write support with replayable differencing files for all supported disk image formats

Mount raw, forensic, and virtual machine disk images as complete (a/k/a “real”) disks on Windows

Decrypt dmg file without key remote