I am trying to get a handle to a locked file in Powershell 5. I tried running the Copy-FileRaw cmdlet from PowerForensics, but get a "Could not find the filerecord requested.." error message. Is PowerForensics supported on Powershell 5?
If that is the case then my previous answer wont work! Lets see if we can pinpoint the error by running Get-FileRecordIndex on each directory leading up to the desired file. Ex. Get-FileRecordIndex -Path C:\ then Get-FileRecordIndex -Path C:\Windows until you get the error.
Powered by IDERA