Thank you. The reason I believe there are other partitions is the large amount of Unused Disk Space. It is well over 3 million sectors of a 30 million sector drive. I remember the instructor harping that all the drive should be accounted for before examining. I'm sure the numbers don't always work out even, but they certainly shouldn't be that far off.
I do believe several of the partitions found are false positives, when I try to define the partition, I get no file structure. However, there are link files showing me locations and drive serial numbers within some of the partitions that were identified with the partition finder. I feel certain the partitions did indeed exist at one time, but they are not there now. Unfortunately, I have no other tools to run against it, and I don't know of any, but if you could suggest one, I would be appreciative.
My question for the hidden partitions had to do with Tweak UI. A friend showed it to me once, and he uses it so he can hide certain things from his kids on the computer. Will EnCase identify partitions hidden with tools such as that?
↧