Copy Locked/In Use Files In Widows: Best Tools For It
Today, we’ll show you how to copy locked files in Windows, like those in C:\Windows\System32\Config or the System Volume Information folder.
Files such as SOFTWARE or SAM can trigger errors like “The action can’t be completed because the file is open in System.”
With the right tools, you can bypass these restrictions. Be sure to also learn how to back up and restore registry hives.
Let’s get started.
What are the best Windows tools to copy locked or in-use files?
1. Robocopy (Built-in Windows Alternative)
Best for advanced users who prefer command line tools, Robocopy is a pre-built option that you can use to quickly copy locked files.
Using it may be intimading if you’re not used to command line tools, but Microsoft also offers the possibility to download a GUI for it, which makes things run smoother.
Robocopy (Robust File Copy) is included in Windows and supports copying locked files using the COPY mode.
Example Command:
robocopy C:\Windows\System32\config C:\Backup /B /E /COPY:DAT/B– Uses backup mode to bypass restrictions./E– Copies all subdirectories./COPY:DAT– Copies data, attributes, and timestamps.
Robocopy is reliable and can be automated with Task Scheduler, making it a solid alternative to third-party tools.
2. Shadow Copy
Shadow Copy uses the Volume Shadow Service allowing you to copy locked and in use files from one location to another with the aid of a simple user interface. It does need installing but you can easily copy the Shadow Copy folder from Program Files and then uninstall again to run the program portably in future.
Usage is pretty easy, browse for a copy from folder (note it will copy what’s in the folder and not the folder itself), browse for a copy to folder and click the Copy button. By default all files will be copied with the all files mask (*.*) which you can change to copy files with a specific extension.
There are a few tick box options below to copy subdirectories, overwrite existing files, ignore errors and parse junction points. Running from the command line is supported but all that really does is open the user interface with predefined from and to locations set and automatically starts the copy.
3. Shadowspawn (formerly HoboCopy)
Shadowspawn is a command-line utility designed to create a read-only shadow copy of a disk, allowing you to access and copy files that are normally in use or locked by the system. Inspired by Microsoft’s Robocopy, it provides a straightforward way to interact with shadow copies, enabling the backup or transfer of files that cannot be accessed during normal operations. The tool mounts the shadow copy as a new drive letter, and you can then run arbitrary commands on it, such as copying files or directories.
To copy locked files, the command syntax is simple:
Shadowspawn /r C:\Windows\System32\config\ C:\Backup
This command will copy the entire contents of the Config folder to the Backup directory. To skip subfolders, remove the /r option. You can also copy individual files from the Config folder by appending their names:
Shadowspawn C:\Windows\System32\config\ C:\Backup SOFTWARE SYSTEMThis will copy only the SOFTWARE and SYSTEM registry hive files to the Backup folder.
If you prefer a GUI, Shadowspawn can be paired with front-end tools to simplify the task. The utility itself remains lightweight and portable, making it easy to run without installation, as long as the Visual C++ runtimes (appropriate for your system’s architecture) are installed.
Shadowspawn is the successor to the now-discontinued HoboCopy, offering similar functionality with enhanced flexibility. It’s a great choice for anyone needing to access and copy files that are otherwise inaccessible while in use.
Download Shadowspawn | Learn more on GitHub
4. Passmark OSForensics
OSForensics may seem a bit overkill because it’s a 50MB+ installer and a full suite of information gathering tools, but the copying of locked and in use files is completely transparent and done from a Windows Explorer style interface. This makes it very easy to use and allows you to copy whole folders full of locked files with minimal fuss.
After install choose to “Continue using the free version”, click the Create Case button and give it a name which places all operations into a profile. Then click File System Browser on the left, choose the drive you want to copy from and click OK.
The file browser will be familiar as it’s like Explorer and you simply use it to locate the in use files or folders you want to copy. Right click on the entry, select Save to disk and choose the folder you want to save to. This makes OSForensics ideal for quickly copying several different folders containing in use files, you can also multi select with Shift+click and Ctrl+click.
5. PC Hunter
If OSForensics is a bit too much for you, PC Hunter is worth a try because it provides a similar Explorer like file and folder tree view so you can easily copy in use files or a whole folder. PC Hunter is actually an advanced anti rootkit tool that operates at an extremely low level on the system, as a result it may trigger an alert in your antivirus.
For such a powerful tool PC Hunter is remarkably simple to use, run the portable 32-bit or 64-bit executable, click on the File tab and use the folder tree to locate the file you want to copy. Right click on the file and choose Copy to. One issue is selecting more than one file will grey out the option although you can still duplicate the whole folder by right clicking on it in the folder tree and using the Copy to option. For advanced users PC Hunter is also very capable at deleting hard to remove files and registry entries although it needs to be used with care.
6. Extents
Extents is a little bit different because it doesn’t use the Volume Shadow Service but instead reads the actual raw clusters on the disk used by the file and reconstructs them into a new file. This has the side effect of bypassing locking or in use restrictions imposed by the operating system.
Only a single file can be handled at a time so it’s best used when you only want to copy one or two files at the most. Run the Extents executable and press Open to look for the in use file. The display will show the disk cluster details of the file. Click the Dump button and choose the save location and filename, make sure to use the same filename and include the extension. Note that Extents doesn’t work perfectly in 64-bit Windows, for instance it will not detect or load open Registry hives like SAM or SOFTWARE.
7. RawCopy
While it’s not exactly the same as Extents in operation, RawCopy is quite similar by using low level disk reading to copy a file from an NTFS formatted disk, whether it’s locked or not. The biggest obvious difference is the fact RawCopy is used from the command line only and has no user interface.
Usage is quite straightforward, simply supply a source path and name of a single file and a destination folder argument to the command, make sure to include quotes if spaces are involved:
rawcopy C:\WINDOWS\system32\config\SYSTEM C:\outputfolder
By default the tool will try to copy using the file’s name, if it cannot because for instance the parent folder has locks on it, RawCopy will then try by using the file index number from the Master File Table. There are 32-bit and 64-bit versions available so make sure you use the correct one.
When dealing with locked files in Windows, choosing the right tool depends on your needs—whether you prefer a command-line approach like Robocopy or Shadowspawn, or a more user-friendly interface like Shadow Copy or OSForensics. These tools help bypass system restrictions, making it easier to copy essential files such as registry hives or system configuration data.
Alternatively, if you also want a lightweight yet effective solution, consider FFCopy, which streamlines file transfers with advanced features. You can download FFCopy here and enhance your workflow for handling locked or in-use files efficiently.
The RawCopy binaries on GitHub are now classified as malware (41% on Virus Total), and chrome refused to let me download the binary alone or the zipped branch.
The problem arises because RawCopy is programmed in the Autoit language and most AVs wrongly class many Autoit based executables as malware. We’ve had the same problem here with our Autoit based tools.
Someone did port RawCopy over to C and you can read about it in the RawCopy issues section on gitHub.
Browse for a copy to folder.
Just wanted to say thanks. This software is very helpful for me.
Just wanted to say thanks! Between OSForensics (really cool suite) and Extents, I was able to get my whole shared drive moved. I love the method Extents uses, too. Another tool for the toolbox.
I got sick and tired of fighting Windows (7 & 10). I found that if you boot Windows into Safe Mode w/Networking, then run Fast Copy, from within Fast Copy you can copy, move, whatever, to anywhere, just set the Source and Destination Directory. It’s SIMPLE and works like a champ!
Nice share Raymond.
I’m using Windows7Ultimate_x64 and I’ll try this.
Thanks for share, keep posting :)
very useful!!