HI FRIENDS,
I GOT A LAPTOP HARD DISK FOR ANALYSIS, I IMAGED THE HARD DISK USING LOGICUBE FALCON WITH DD IMAGE. I UPLOADED THE IMAGE IN ENCASE 5 AND 6 FOR ANALYSIS. TO MY SURPRISE I GOT THE SCREEN OF ENCASE AS UNUSED DISK AREA AND NO FILE STRUCTURE COULD BE SEEN. I COULD ABLE TO FIND OUT THAT THERE IS EFI PARTITION ALONG WITH NTFS, BUT NO FILE STRUCTURE IS SEEN. I USED THE AUTOPSY BUT COULD NOT LOAD THE IMAGE. HOW CAN I ANALYSE THE DISK FOR DATA. IS IT THERE ANY OTHER TOOLS TO SEE THE DATA.
EVEN I HAVE CLONED THE ORIGINAL HARD DISK AND TRIED TO BOOT THRU THE CLONED HARD DISK, BUT THE CLONED DISK IS NOT RECOGNISED BY THE SYSTEM AND BOOTING FAILED. PL SUGGEST THE SOLUTIONS EITHER TO BOOT THRU THE CLONED HARD DISK OR HOW TO ANALYSE THE DISK. PL SUGGEST ANY TOOLS, THANKS IN ADVANCE.
KRISHNA M
krishna, please check your keyboard, your CAP is on (and it seems like you are SHOUTING at people).
"EFI partitioned" do not exist.
A disk can be either "MBR style" or "GPT style".
GPT is part of the EFI specifications, but it is not in itself "EFI".
The GPT scheme includes a "protective entry" in the MBR covering the whole size of a disk with an ID of EE.
Any tool/program/Os not updated to manage GPT will see only a large partition with "unknown ID".
Check here
http//
http//
jaclaz
Do you know anything about the OS that is installed on the hard drive or from what sort of laptop it came from? (Make Model OS, etc?)