4

When doing data forensics, sometimes you need just the free space of a filesystem, to run further analysis/heuristic processing on. Is there any tool that allows just imaging the free space? Anything that I can find only supports imaging the used space.

  • 2
    What do you mean by imaging? What features should the software have? – Aswin P J May 1 '16 at 18:14
  • 1
    @AswinPJ By imaging, Afuna means saving a binary image of all the free space on the media. – RockPaperLizard May 1 '16 at 22:52
  • @RockPaperLizard I'm aware of what "imaging" usually means in this context. But "speaking forensics", an image usually is a 1:1 copy of a medium – regardless of used or unused space. Maybe I'm not up-to-date on the topic – according to the answer, this seems to be the case :) – Izzy May 5 '16 at 21:59
  • 2
    @Izzy An image can be of any part of the drive. You're absolutely right, it's normally the entire medium. But for some tasks, you want to isolate the free space. This can be done by just imaging the free space, or by taking relevant slices of an image of the entire medium. For large drives with little free space, this can be very useful. One of the tricks, though, is that if you just look at unallocated clusters, you miss all the data between the EOF (End of File) and the the EOC (End of Cluster). – RockPaperLizard May 5 '16 at 22:14
3

There is Access Data FTK Imager Lite which is a ~5 year old free version of their commercial product.

I never exported unallocated space before, but it seems to work:

  1. Add a logical drive as an evidence item.
  2. Expand the tree
  3. Select [unallocated space]
  4. Right click, select "Export Logical Image (AD1)..."
  5. Click "Add..." to define the destination image file
  6. Click "Next" when being asked for evidence item information
  7. Click "Finish" after defining the file name
  8. Click "Start" to actually start the imaging process

FTK Imager exporting unallocated space

To analyze the data:

  1. Click "File/Image Mounting..."
  2. Select the AD1 file created before
  3. Click the "Mount" button

You'll now have a disk drive with folders and files that have numbers as their names. You can open them in a text or hex editor and investigate.

Disadvantages:

  • the progress bar seems to be about single pieces of unallocated space. It's hard to track the real progress. This may become better if you check the box "Precalculate progress statistics", which I didn't
  • the file format is AD1, which is an Access Data format. You may not find other tools that can open this kind of file.
| improve this answer | |
  • Thanks for the idea. Unallocated space is space on the drive that isn't allocated to a specific partition. What I really need to get the unused space within an active parition/filesystem. – Reinstate Monica May 3 '16 at 6:52
  • @afuna: Hmm, I slightly disagree, but I can't prove it at the moment. As you can see, I added a logical drive and the unallocated space is below that logical drive, so IMHO it is within my C: partition of the screenshot. – Thomas Weller May 3 '16 at 20:09
  • Oh. Sorry. I hadn't seen the image yesterday. Its looks like your right. Thanks! I'll give it a try. – Reinstate Monica May 4 '16 at 9:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.