5

When doing data forensics, sometimes you need just the free space of a filesystem, to run further analysis/heuristic processing on. Is there any tool that allows just imaging the free space? Anything that I can find only supports imaging the used space.

4
  • 2
    What do you mean by imaging? What features should the software have?
    – Aswin P J
    May 1, 2016 at 18:14
  • 1
    @AswinPJ By imaging, Afuna means saving a binary image of all the free space on the media. May 1, 2016 at 22:52
  • @RockPaperLizard I'm aware of what "imaging" usually means in this context. But "speaking forensics", an image usually is a 1:1 copy of a medium – regardless of used or unused space. Maybe I'm not up-to-date on the topic – according to the answer, this seems to be the case :)
    – Izzy
    May 5, 2016 at 21:59
  • 2
    @Izzy An image can be of any part of the drive. You're absolutely right, it's normally the entire medium. But for some tasks, you want to isolate the free space. This can be done by just imaging the free space, or by taking relevant slices of an image of the entire medium. For large drives with little free space, this can be very useful. One of the tricks, though, is that if you just look at unallocated clusters, you miss all the data between the EOF (End of File) and the the EOC (End of Cluster). May 5, 2016 at 22:14

1 Answer 1

4

There is Access Data FTK Imager Lite which is a ~5 year old free version of their commercial product.

I never exported unallocated space before, but it seems to work:

  1. Add a logical drive as an evidence item.
  2. Expand the tree
  3. Select [unallocated space]
  4. Right click, select "Export Logical Image (AD1)..."
  5. Click "Add..." to define the destination image file
  6. Click "Next" when being asked for evidence item information
  7. Click "Finish" after defining the file name
  8. Click "Start" to actually start the imaging process

FTK Imager exporting unallocated space

To analyze the data:

  1. Click "File/Image Mounting..."
  2. Select the AD1 file created before
  3. Click the "Mount" button

You'll now have a disk drive with folders and files that have numbers as their names. You can open them in a text or hex editor and investigate.

Disadvantages:

  • the progress bar seems to be about single pieces of unallocated space. It's hard to track the real progress. This may become better if you check the box "Precalculate progress statistics", which I didn't
  • the file format is AD1, which is an Access Data format. You may not find other tools that can open this kind of file.
3
  • 1
    Thanks for the idea. Unallocated space is space on the drive that isn't allocated to a specific partition. What I really need to get the unused space within an active parition/filesystem. May 3, 2016 at 6:52
  • 1
    @afuna: Hmm, I slightly disagree, but I can't prove it at the moment. As you can see, I added a logical drive and the unallocated space is below that logical drive, so IMHO it is within my C: partition of the screenshot. May 3, 2016 at 20:09
  • 1
    Oh. Sorry. I hadn't seen the image yesterday. Its looks like your right. Thanks! I'll give it a try. May 4, 2016 at 9:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.