When doing data forensics, sometimes you need just the free space of a filesystem, to run further analysis/heuristic processing on. Is there any tool that allows just imaging the free space? Anything that I can find only supports imaging the used space.
There is Access Data FTK Imager Lite which is a ~5 year old free version of their commercial product.
I never exported unallocated space before, but it seems to work:
- Add a logical drive as an evidence item.
- Expand the tree
- Select [unallocated space]
- Right click, select "Export Logical Image (AD1)..."
- Click "Add..." to define the destination image file
- Click "Next" when being asked for evidence item information
- Click "Finish" after defining the file name
- Click "Start" to actually start the imaging process
To analyze the data:
- Click "File/Image Mounting..."
- Select the AD1 file created before
- Click the "Mount" button
You'll now have a disk drive with folders and files that have numbers as their names. You can open them in a text or hex editor and investigate.
- the progress bar seems to be about single pieces of unallocated space. It's hard to track the real progress. This may become better if you check the box "Precalculate progress statistics", which I didn't
- the file format is AD1, which is an Access Data format. You may not find other tools that can open this kind of file.