How to Acquire the NTFS $LogFile (Live and Dead Box)
Copy the locked NTFS $LogFile and its $MFT: KAPE, Velociraptor, FTK Imager, RawCopy, icat and ntfscat commands, plus checks that prove the copy is usable.
Copy the locked NTFS $LogFile and its $MFT: KAPE, Velociraptor, FTK Imager, RawCopy, icat and ntfscat commands, plus checks that prove the copy is usable.