$Boot

$Boot

Windows
1 path
$Boot
Version 1
Eric Zimmerman

Paths on disk

1 path

References

1 link

digital-forensics.sans.org/media/DFIR-Command-Line.pdf(opens in new tab)

Collect it

KAPE command line for $Boot

Source

Destination

--vss--vhdx

kape.exe --tsource C: --tdest D:\Evidence --target $Boot

Run with administrator privileges. KAPE Documentation

Part of these collections

6 collections collect this target