For a forensics purpose, I need to create a NTFS disk that looks like the machine collected and I wish to modify the content of $MFT with the file $MFT that I collected.
As you suspect I've got an "Operation not permitted"
I've tried to modify NTFS attributes (system.ntfs_attrib_be), ACL, mount with different options, etc.
Can I do it some how ?
Hello,
For a forensics purpose, I need to create a NTFS disk that looks like the machine collected and I wish to modify the content of $MFT with the file $MFT that I collected. As you suspect I've got an "Operation not permitted"
I've tried to modify NTFS attributes (system.ntfs_attrib_be), ACL, mount with different options, etc. Can I do it some how ?
Thx, Merci