±Your Account
Membership:
New Today: 0
New Yesterday: 4
Overall: 24209
Visitors: 47±Latest Webinar
±Latest Articles
· Android Forensics
· Geo-tagging & Photo Tracking On iOS
· KS – an open source bash script for indexing data
· Mobile Device Geotags & Armed Forces
· Categorization of embedded system forensic collection methodologies
· Interpretation of NTFS Timestamps
· What are ‘gdocs’? Google Drive Data – part 2
· What are ‘gdocs’? Google Drive Data
· Bad Sector Recovery
· Forensic Artifact: Malware Analysis in Windows 8
· Geo-tagging & Photo Tracking On iOS
· KS – an open source bash script for indexing data
· Mobile Device Geotags & Armed Forces
· Categorization of embedded system forensic collection methodologies
· Interpretation of NTFS Timestamps
· What are ‘gdocs’? Google Drive Data – part 2
· What are ‘gdocs’? Google Drive Data
· Bad Sector Recovery
· Forensic Artifact: Malware Analysis in Windows 8
±Follow Us
±Latest Jobs
Back to top
Skip to content
Skip to menu
Back to top
Back to main
Skip to menu
Free tool to extract unallocated space
Free tool to extract unallocated space
Posted: Tue Dec 21, 2010 6:18 am
Does anyone know of a free acquisition tool that can be run on a system (dead or live) that can extract JUST unallocated space?
thanks,
Jacob
thanks,
Jacob
-
jakeaw03 - Senior Member
Re: Free tool to extract unallocated space
Posted: Tue Dec 21, 2010 8:49 am
Yes, FTK Imager
_________________
Blog: secureartisan.wordpress.com
_________________
Blog: secureartisan.wordpress.com
-
pbobby - Senior Member
-
jakeaw03 - Senior Member
Re: Free tool to extract unallocated space
Posted: Fri Dec 24, 2010 4:23 pm
Hello,
When looking at FTK Imager I didn't see the option to just image the unallocated space of the drive. The only options were the whole drive, the logical drive, a particular file (which stated that it was not going to get the unallocated spaces etc.).
Pbobby, please let me know where the option is to just image the unallocated space is.
Thanks,
When looking at FTK Imager I didn't see the option to just image the unallocated space of the drive. The only options were the whole drive, the logical drive, a particular file (which stated that it was not going to get the unallocated spaces etc.).
Pbobby, please let me know where the option is to just image the unallocated space is.
Thanks,
-
jakeaw03 - Senior Member
Re: Free tool to extract unallocated space
Posted: Fri Dec 24, 2010 5:39 pm
Mount the drive/image in FTK Imager and it will show you the unallocated drive.
-
dpcdigex - Member
Re: Free tool to extract unallocated space
Posted: Sat Dec 25, 2010 5:56 am
To make it clear. To image unallocated space.
After mounting image/drive in FTK Imager, You will see [unallocated space] folder in Evidence Tree window.
Now just right click “Export Files” (and recommended “Export File Hash List” which will compute md5 and sha1)
_________________
Michal Kedziora
CISSP, EnCE, CompTIA Security+, CEH
Wroclaw University of Technology
Blog: www.forensics-research.com
After mounting image/drive in FTK Imager, You will see [unallocated space] folder in Evidence Tree window.
Now just right click “Export Files” (and recommended “Export File Hash List” which will compute md5 and sha1)
_________________
Michal Kedziora
CISSP, EnCE, CompTIA Security+, CEH
Wroclaw University of Technology
Blog: www.forensics-research.com
-
Michalwrp - Member