Blog

How deleted files survive in unallocated clusters, how to pull them out by signature, and the reasons (TRIM, fragmentation) the data often is not there.

What actually replaces FTK Imager for browsing and exporting from a disk image, where the browser wins, and where you still need the real thing.

Most online disk image viewers upload your evidence to a server. Here is how to read one in the browser with nothing leaving the machine, and how to prove it.

The bytes past a file's logical end, inside its last cluster, where fragments of older deleted files survive. How slack works and how to extract it.

A practitioner's checklist for disk images that refuse to mount: format mismatches, split sets, truncated acquisitions, wrong sector size and corruption.

Detect filesystems from the superblock instead of trusting the partition type byte. Magic numbers, the offsets that trip people up, and faking it.

Browse an Expert Witness Format (E01) image without FTK Imager or a local install. How EWF segments, compression and hashing actually work.

Walk the partition table of a disk image yourself: MBR's 64 bytes, the EBR chain, GPT headers, CRCs, and the offset bugs that read the wrong sector.