(03-28-2018, 10:55 AM)undeath Wrote: you can run modes 13713, 13723, 13733 and 13753 which will cover all non-boot possibilities.
and header extraction is like so?
dd if=\\.\Volume{some-vo-lu-me-qwerty} of=hashcat.vc bs=1 skip=65536 count=512
upd: dd for windows fails to access volume
Error reading file: 87 The parameter is incorrect.
Any suggestion what tool i can use to get volume header in win10?