In the presentation for section 3, there is an image representing a disk with 2 volumes and two sections of unused space. Reference is made to the unused/unallocated space made into files, so I would expect that in Autopsy this would be represented as 2 volumes plus 2 files. During the quiz for the first lab, the answer doesn’t seem to follow this logic. Is there a more detailed explanation for how it is represented for this test image?
where will i find the device1_laptop.e01 for the lab . i dont havve any links to get the dataset
It is in Section 1, where the first item is called “Download List” and has links to the materials.
I recall the discussion stated that unallocated space is treated as a file during the examination or analysis. However it is still represented as a volume without a physical drive number or logical drive letter.
Hope my answer helps clarify your doubt.
My question was more about being consistent about how the unallocated space is shown. There are two types of unallocated space - the unused space inside a volume, and the unused space that is outside the volume boundaries. According to the description, I was expecting a file called $Unalloc* inside a volume, and then separate files called $Unalloc* to represent the unused space outside the volume system. I just now went back to the video and found the slide at approx 14:40 with an image that showed both these instances, but with the external empty space shown within a volume called “vol3 (Unallocated: …)” which answered my question.
1 Like