When a physical hard disk is divided into partitions, very rarely do all sectors of the disk get allocated to partitions. In other words, there are sectors in the drive that remain unallocated. These sectors are normally hidden from the end user, thus making it a prime location for hiding data. The 'Raw Disk Viewer' module can help locate these unallocated sectors, allowing the user to view its raw contents. To do this, we need first identify which sectors are allocated to partitions.
Select the physical disk (without a partition) in the drop-down list. This is important as the MBR and partition table are outside of the partitioned space.
Ensure the cursor is within the first sector (Sector 0) of the disk. In the Data Interpreter window, the partition table is displayed in a readable format.
In this example, the disk contains extended partitions. Looking at Partition 4, there seems to be a gap between the EBR structure and the first sector of this partition. This gap is known as "Inter-partition space", which is often left unused. However, it is not uncommon that data of interest is found within these sectors.
Notice that there is also a gap between the last sector of Partition 4 and the EBR of Partition 5. These sectors were originally allocated to a partition, but was deleted some time later. In these sectors (known as "Unused space"), remnants of files from the old partition may be found here.
Finally, verify whether or not the last partition spans to the last sector of the disk
According to the 'Decode' window, the total number of sectors is 514080. However, the last sector of Partition 5 is 426623, implying that there are unallocated sectors at the end of the disk (known as "Unused space").
Use the raw disk viewer to view the contents of these unallocated sectors. You can also perform a hex/string search to locate key patterns, or attempt to recover any files using the 'Deleted Files Search' module's file carving functionality.