Autopsy is showing an unallocated volume that has the standard “Invalid partition table” string, but the whole volume is written with zeroes.
Does this imply some sort of attempt to delete/remove the data?
Can anyone shed any light please?
Hi. Can you tell us about how you acquired the original image and where it is from? If the entropy of the file shows that it is all 0x00 then it sounds like you are either working with an image of brand new or totally wiped hard drive or perhaps the image came from failing hardware that returned 0x00 during the acquisition process.