I am trying to get a handle to a locked file in Powershell 5. I tried running the Copy-FileRaw cmdlet from PowerForensics, but get a "Could not find the filerecord requested.." error message. Is PowerForensics supported on Powershell 5?
Lee Holmes and I were working through an issue with UsnJrnl parsing in PowerForensics. Turns out the root cause of our issue is likely the root cause of the issue that you are having.
We found an error in the code that parses the DataRuns (these are the structures that tell us where a file resides on disk). This error caused us to not read the entire $MFT file and miss some of the higher MFT records.
We are working through some testing, but I will let you know when the code is pushed to github (hopefully just a couple days).
Awesome. Looking forward to it.
The issue should be fixed on the latest version that I published to the PowerShell Gallery. www.powershellgallery.com/.../PowerForensics
Powered by IDERA