Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20115

Forensic Software: Recovering Hidden FAT16 partition

$
0
0
It's the forum preview that makes the image not readable. Opening it in a new page it becomes sharper/bigger and thus readable. But without the actual hex dump it is of course impossible to read the "dots". The MSWIN4.0 and the IO.SYS and MSDOS.SYS "system files" are enough to say that it is a MS-DOS botable bootsector. MSWIN4.0 should mean Windows 95 "A". The "LHIDDEN" label is not however the "standard" one, which is "NO NAME". As well the original Windows 95 bootsector, if memory serves me well, should also contain the name of the "third" system file "WINBOOT.SYS". jaclaz

Viewing all articles
Browse latest Browse all 20115

Trending Articles