Dear All,
Learing my way through computer forensics still a bit of a novice so appoligies if this question seems basic.
I have a hard disk which has two partitions on it. Is an old drive. The two partitions are fat 16, They both contain a volume boot records. Am I write in saying that an OS was installed on both partitions?
Kaly
No. Every FAT drive has a VBR at the start of each volume. You will need to examine the contents of each partition to determine if an operating system has been installed.
Thanks for the reply tony,
I have checked the partitions and the c\ partition has what you would expect to find on a windows system. I checked the Registry to see what the OS is “ Win 98”. The volume boot record on the C\ partition had no mswin 4.1 entry so my thoughts are that some programme removed the mswin 4.1 entry to stop the machine booting.
Because c\ and D;\ had no Mswin4.1 entry in the volume boot and that D\ partition had a volume boot record I thought that an OS was installed on both partitions
I think I am just over thinking it. I just wanted to check to if I could establish what OS has been installed onto the disk. Using a hex viewer. ?