Friday, June 5, 2015

Working with media - Unallocated Space


Unallocated space is space which the operating system (OS) is able to write to and is not currently allocated for any other purpose and thus is free for use by the OS (whereismydata.wordpress.com, 2008). 

Considering the drive below, let’s first take a look using GParted. 


For the image above, with the exception of a few bytes being used, most of this disk is practically unallocated. The image shows no “Used” space, thus for practicality purposes, the entire drive is unallocated.
 

Unallocated space is also represented on the disk via a series of 00 00 00 (whereismydata.wordpress.com, 2008). The image below shows the majority of the bytes to be 00 00 00.
 
Hope you find this information helpful and please see the other posts in this series for additional information on working with media.


Reference:
https://whereismydata.wordpress.com/2008/10/03/what-is-unallocated-space/
https://whereismydata.wordpress.com/2009/06/27/forensics-what-is-imaging/



In this series

Working with media - Unallocated Space
Working with media - Allocated Space
Working with media - Partitioning
Working with media - Sectors
Working with media - Clusters
Working with media - Slack Space
Forensic Imaging and their Formats - The Advanced Forensic Format (AFF)
Forensic Imaging and their Formats - Encase Image (E01)Forensic Imaging and their Formats - DD (raw)

No comments:

Post a Comment