#Disk forensics: How to view deleted part of a disk image?

1 messages · Page 1 of 1 (latest)

tulip pecan
#

Hey
This is certainly doable using the pattern language but you'd need to write a parser for your filesystem first probably.
There is a pattern that can parse MBR and EFI tables to figure out where partitions are and also part of FAT32 paritions but that's about it for now: https://github.com/WerWolv/ImHex-Patterns/blob/master/patterns/fs.hexpat

GitHub
ImHex-Patterns/patterns/fs.hexpat at master · WerWolv/ImHex-Patterns

Hex patterns, include patterns and magic files for the use with the ImHex Hex Editor - WerWolv/ImHex-Patterns

#

ImHex would work fine for that as long as you can tell it how the data is structured