0

I have been given an HDD image. I believe the image was taken with dd. I have ingested the file using Autopsy and can see there are 4 volumes, like so

  • Volume 1 - Unallocated. I believe NOT securely deleted
  • Volume 2 - NTFS / exFAT. Windows Vista, not deleted
  • Volume 3 - DOS FAT 12. Not deleted.
  • Volume 4 - Unallocated

I would like to know how (if possible), to recover Volume 1 so that I can mount the image in a Virtual Machine. I would also like to recover Volume 4.

Note: I have access to Windows and Linux to perform this analysis.

finkforensics
  • 1
  • 1
  • 1
    There is a difference between mounting it and booting it. Do you really want to boot from this volume, or just mount it to see/recover data? – Ron Beyer Apr 18 '19 at 15:59
  • Good point. Ultimately I need to read the data, so mounting would suffice. I would like to boot as well but would settle for you just mounting. – finkforensics Apr 18 '19 at 20:36
  • 1
    There are plenty of recovery options / methods. What did you attempt so far ? – Overmind Apr 19 '19 at 05:06

0 Answers0