hey HaQue, generous hand there dude, that's the kind of "show of effort" I would have expected from the OP.
You are indeed "the bomb diggity"
generic help guide-
help vampire: elicits least response
Help! how do i do this.... (i have done nothing for myself here and am begging for charity)
---
noob but willing to do some leg work: elicits some help and encouragement
I've been given this as a task. I have a XXGB drive / small sample from a XXGB drive.
So far I think, from looking around the web, that it's FATXX.
Despite finding some paid for programs I think may help, I need to find a free solution.
I found this guide on C Greniers site and need a push in the right direction understanding this part ....
---
sh*t-hot candidate (i'm looking to help others / impress lecturers & prospective employers / anyone else remotely interested): best ROI / help / interest possible.
So, guys, I got this as an assignment/job/selfstart on boot sectors and FAT's and am looking to pass the good news on.
The tutor/employer doesn't trust us to drive Encase/FTK yet so all we have access to is a basic hex editor.
Here's the job detail. (how to get around the zero'd area), but I really think it's an initiative test to see if we can self start.
This is a [hypothetical instance] / [real drive] and [no other data has been provided] / [there are other incriminating artifacts on here].
I've found/begged/borrowed a few spare drives and some old MS install disks i tried Win 95 / 2000 / XP / Vista / 7 and a linux distro installs for good measure.
Also bounced this around a few guys I pulled together at uni/college/work after hours in the workshop.
From the results, (see screenshot) I'm thinking its a XX installation where someone has tried to cover their tracks by ....< means>
It seems there maybe a copy of the FAT someplace and I think I'm on the right track here with ...<blah> but really i just need a way to show i can reconstruct the first few blocks here that have been zeroed.
If anyone can help flesh this out, or correct some of my inevitable mistakes, so others as well as myself may benefit, I'd be grateful.
<blah / gratuities>
-----
again it's worth referencing ESR's guide as a start point for folks looking for help via fora or other social media.
Well worth the investment of time taken in reading it.
K