I am writing a computer forensics paper and I have been looking at the reserved system partition that Windows 7 automatically creates on new installations, it is 100MB in size with most of the space being empty.
It appears that the partition main use is Bitlocker, my main doubt is if that partition contains any useful information for a computer forensics expert assuming the person did not use Bitlocker and he used something like Truecrypt or PGP disk encryption on the main partition containing the OS.
I have only managed to find data about the bootloader and one hidden folder called "Recycle bin" but I am not able to see anything useful there, like filenames (using a Hex editor for that).
Anyone knows if Windows 7 reserved system partition can contain the file names of fata stored in the main encrypted partition or some kind of useful back up files? Or is it really just 100% bootloader data?
I came across a presentation that explains how to extract a Bitlocker recovery key out of that system recovery partition, but my main focus is on non Bitlocker products like Truecrypt or PGP WDE.