Series
Browser-based disk forensics
8 posts in this series. Read them in order or jump to any one.
- Open an E01 disk image in your browser
Browse an Expert Witness Format (E01) image without FTK Imager or a local install. How EWF segments, compression and hashing actually work.
- Reading MBR and GPT partition tables by hand
Walk the partition table of a disk image yourself: MBR's 64 bytes, the EBR chain, GPT headers, CRCs, and the offset bugs that read the wrong sector.
- Identify NTFS, FAT, exFAT and ext by signature
Detect filesystems from the superblock instead of trusting the partition type byte. Magic numbers, the offsets that trip people up, and faking it.
- Why your disk image won't open
A practitioner's checklist for disk images that refuse to mount: format mismatches, split sets, truncated acquisitions, wrong sector size and corruption.
- FTK Imager alternatives that run in your browser
What actually replaces FTK Imager for browsing and exporting from a disk image, where the browser wins, and where you still need the real thing.
- Open a disk image online without uploading it
Most online disk image viewers upload your evidence to a server. Here is how to read one in the browser with nothing leaving the machine, and how to prove it.
- Carve deleted data from unallocated space
How deleted files survive in unallocated clusters, how to pull them out by signature, and the reasons (TRIM, fragmentation) the data often is not there.
- Recovering file slack from a disk image
The bytes past a file's logical end, inside its last cluster, where fragments of older deleted files survive. How slack works and how to extract it.