Unallocated space analysis
ID: 820446b5-6db2-5c78-962a-de9b5a5da10b
STIX ID: report--820446b5-6db2-5c78-962a-de9b5a5da10b
Feed Name: Pen Test Partners Blog
This report outlines the forensic value of unallocated disk space in investigations, emphasizing how remnants of deleted or reformatted data can reveal user activity and potential data exfiltration. It details the use of PhotoRec for signature-based file carving and describes mounting unallocated space to enable targeted searches for documents, archives, and scripts. The guidance highlights how recovered artifacts and timestamps can reconstruct timelines and expose attempts to tamper with or conceal evidence.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.