WinXP: kopie syst. souborů za běhu?

AccesData FTK Imager -Obtain Protected Files

FTK Imager is a data preview and imaging tool that lets you quickly assess electronic evidence to determine if further analysis with AccessData® Forensic Toolkit® (FTK™) is warranted. FTK Imager can also create perfect copies (forensic images) of computer data without making changes to the original evidence.

FTK Imager allows you to acquire physical device images, create multiple images from a single source and provides ready access to CDFS and DVD file systems.

FTK Imager is for law enforcement and every IT, IS and Security professional interested in copying data from FAT, NTFS EXT 2 and 3 as well as HFS and HPFS file systems.

Additionally, FTK Imager allows you to truly multi-task by creating multiple images from a single source and/or multiple images simultaneously. FTK Imager generates DD, SMART and Encase® images and reads several other industry standard formats.

With Isobuster technology built in, FTK Imager provides ready access to CDFS and DVD file systems - to include multi and open session CDs.

Download Imager today and begin using the following additional functionality to assist in your data triage and acquisition:

* Acquire locked system files (such as SAM / SYSTEM / NTUSER)
* Hash physically or logically for verification (MD5 and SHA1)
* Preview media (thumbnail views, keyword searches, properties)

http://www.accessdata.com/common/pagedetail.aspx?Pa geCode=downloads

K tomu slouzi Shadow Copy provider - systemove soubory se bezne zalohuji (ntbackup) nebo za behu kopiruji (image disku).

všechny "ghostovací" programy to umí, dělají image běžícího systému.
pravda, specializují se na celé partitions.