# kfallahi/UnderlayCopy

<https://repo.masters-masters.com/en/repos/kfallahi/UnderlayCopy>

[Home](https://repo.masters-masters.com/en) › [kfallahi](https://repo.masters-masters.com/en/owners/kfallahi) › [UnderlayCopy](https://repo.masters-masters.com/en/repos/kfallahi/UnderlayCopy)

kfallahi/UnderlayCopy has 256 stars on GitHub. Its RepoMasters card: Alpha tier. PowerShell toolkit that extracts locked Windows files (SAM, SYSTEM, NTDS…

| Field | Value |
| --- | --- |
| Owner | [kfallahi](https://repo.masters-masters.com/en/owners/kfallahi) |
| Stars | 256 |
| Forks | 25 |
| Language | [PowerShell](https://repo.masters-masters.com/en/languages/powershell) |
| License | None |
| Created | 2025 |
| Topics | dfir, ntfs, red-team |
| Tier | [Alpha (250 to 699 ★)](https://repo.masters-masters.com/en/ranks/b_movie) |
| View on GitHub | [kfallahi/UnderlayCopy](https://github.com/kfallahi/UnderlayCopy) |

## Repository

PowerShell toolkit that extracts locked Windows files (SAM, SYSTEM, NTDS, ...) using MFT parsing and raw disk reads

The tier for repos with 250 to 699 ★. Published odds per card pulled: 20%. Rarity: Uncommon.

## Nearby in PowerShell

- [RuiRomano/pbimonitor · ★ 257 · PowerShell · Alpha](https://repo.masters-masters.com/en/repos/RuiRomano/pbimonitor)
- [SCRT-HQ/PSGSuite · ★ 256 · PowerShell · Alpha](https://repo.masters-masters.com/en/repos/SCRT-HQ/PSGSuite)
- [ScorpionesLabs/DVS · ★ 256 · PowerShell · Alpha](https://repo.masters-masters.com/en/repos/ScorpionesLabs/DVS)
- [HarmJ0y/PowerUp · ★ 255 · PowerShell · Alpha](https://repo.masters-masters.com/en/repos/HarmJ0y/PowerUp)
- [OtterHacker/M365Pwned · ★ 255 · PowerShell · Alpha](https://repo.masters-masters.com/en/repos/OtterHacker/M365Pwned)

---
Data: GitHub · Illustration drawn by RepoMasters from the repo’s ID and its language color.