ANALYSIS OF EFI PAR...
 
Notifications
Clear all

ANALYSIS OF EFI PARTITIONED DISK

3 Posts
3 Users
0 Likes
1,167 Views
(@krishna)
Posts: 45
Eminent Member
Topic starter
 

HI FRIENDS,

I GOT A LAPTOP HARD DISK FOR ANALYSIS, I IMAGED THE HARD DISK USING LOGICUBE FALCON WITH DD IMAGE. I UPLOADED THE IMAGE IN ENCASE 5 AND 6 FOR ANALYSIS. TO MY SURPRISE I GOT THE SCREEN OF ENCASE AS UNUSED DISK AREA AND NO FILE STRUCTURE COULD BE SEEN. I COULD ABLE TO FIND OUT THAT THERE IS EFI PARTITION ALONG WITH NTFS, BUT NO FILE STRUCTURE IS SEEN. I USED THE AUTOPSY BUT COULD NOT LOAD THE IMAGE. HOW CAN I ANALYSE THE DISK FOR DATA. IS IT THERE ANY OTHER TOOLS TO SEE THE DATA.

EVEN I HAVE CLONED THE ORIGINAL HARD DISK AND TRIED TO BOOT THRU THE CLONED HARD DISK, BUT THE CLONED DISK IS NOT RECOGNISED BY THE SYSTEM AND BOOTING FAILED. PL SUGGEST THE SOLUTIONS EITHER TO BOOT THRU THE CLONED HARD DISK OR HOW TO ANALYSE THE DISK. PL SUGGEST ANY TOOLS, THANKS IN ADVANCE.

KRISHNA M

 
Posted : 17/06/2016 12:04 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

krishna, please check your keyboard, your CAP is on (and it seems like you are SHOUTING at people).

"EFI partitioned" do not exist.

A disk can be either "MBR style" or "GPT style".

GPT is part of the EFI specifications, but it is not in itself "EFI".

The GPT scheme includes a "protective entry" in the MBR covering the whole size of a disk with an ID of EE.

Any tool/program/Os not updated to manage GPT will see only a large partition with "unknown ID".

Check here
http//www.rodsbooks.com/gdisk/
http//www.rodsbooks.com/gdisk/whatsgpt.html

jaclaz

 
Posted : 17/06/2016 12:17 am
(@wookieshaver)
Posts: 27
Eminent Member
 

Do you know anything about the OS that is installed on the hard drive or from what sort of laptop it came from? (Make Model OS, etc?)

 
Posted : 17/06/2016 9:13 pm
Share: