ntfsDump

Use to copy a file from an NTFS partitioned volume by reading the raw volume and parsing the NTFS structures

💭 Used successfully for reading ntds.dit on a DC

https://github.com/3gstudent/ntfsDump