Hello everybody,
I've recently been given a HD, and told that it hasn't been manipulated. However, my first surprise has consisted in discovering that EnCase recognises the disk as a part of a RAID or Dynamic Disk. I must say that this is the very first time I saw that icon, I even had to look it up in the manuals!
The question is that when I scan its disk configuration, EnCase just gives me the typical NTFS folders $Extend and System Volume Information, the typical internal files ($MFT, $Volume, etc.), the Volume Slack, the Unallocated Clusters… and that's all!!! I know that there are several different approaches I can take know to recover files and stuff, but my question is this am I facing a formatted or fdisked disk?? Because, otherwise I should see a kind of file systems structure or something, right?
The real question behind this, is that the $MFT file (and all the internal files like it) have the same date and time for the Last Written, Entry Modified, File Created and Last Accessed attributes. This date could represent the date the disk was formatted/fdisked??
Thank you for your time, guys.