I made an image of a External Hard drive using FTK Imager. The image is in Encase format. I recovered some partitions and pictures from the image using "Active File Recovery" tool.
The Hard drive was seized from the leader of a criminal gang. I have to determine what was done with the hard drive.
How will I determine that?
Please reply asap. Thanks.
The Hard drive was seized from the leader of a criminal gang. I have to determine what was done with the hard drive.
If this is true … then you are apparently in over your head, as you presumably have a job that you have to ask how you do it. Have a chat with your boss or supervisor or whatever.
If it is not literally true, … say, you are a student and have got this as an assignment or a test … you better say so. Or refrmulate your question … it needs to be less clueless. You'll get better replies that way, too.
Hey, it would help if you tell us what exactly it is you wish to achieve.
Hi, first read about MBR, MFT and Files System