Does somebody know how to clone the unallocated space of a ntfs partition?

technically, if it is unallocated, it isnt part of an NTFS partition, else it would be allocated..If I have it right.. do you mean clone the unallocated space on a disk where there also is an NTFS partition?
or do you mean free space inside the NTFS partition that the cloning tool skips.

Could you clone the whole disk and manually remove the partitions, using DMDE for the offset info, leaving the unallocated space

I havent dabbled too much in partitioning at a hex level so I may be off the mark.

Use ddrescue and specify the starting and ending LBAs of the unallocated space.

_________________
A backup a day keeps DR away.

@ HaQue
well i try to explan better:

i need to clone the unallocated LBA's of a NTFS partition.
so for example: this partition is 500GB, 150GB allocated to files, 350GB unallocated to files.
i want to get a image of 350 GB, of slack space and unallocated space ONLY.
(maybe i shoud have posted into forensic section)

@ fzabkar
didn't see that function in its guide, are u sure about it?

if files are fragmented, this could be hit or miss
Im wondering what the purpose would be for

sure files are fragmented, but there is a map/list of this fragments, so it should be easy for a software to exclude the lbas referring to allocated files.

As Haque has explained, the term "unallocated" has a different meaning than the one you intended. Therefore my advice is not applicable and ddrescue cannot do what you want.

_________________
A backup a day keeps DR away.

@ fzabkar:
yes u right, correct term is free space not unallocated.

there is a way to clone a existing partition including only the free space and slack space?

I've never heard of anyone wanting to do what you want, but I know that DR tools can search free clusters and the slack space at the end of files. That said, most files don't end on a sector boundary, so how would you handle a partial sector?

_________________
A backup a day keeps DR away.

you mean this ?
http://blog.priveonlabs.com/sec_blog.ph ... &tb=1&pb=1

we can't deal with partial sector...that's impossible so far i understand.

Could you image the entire drive and then use a wipe utility to zero every file? This should leave the free clusters untouched, but you would need to verify whether the tool overwrites the slack space.

_________________
A backup a day keeps DR away.

Easy with DeepSpar

1. select all sectors by mft and bitmap
2. invert selection
3. click "restart scan" on the start scan screen
4. wipe unprocessed sectors when project is complete (this clears out the MFT, MBR and Bitmap sectors read to get the original selection)

_________________
Luke
Recovery Force Donor Inventory: 5,000+ Fully Cataloged HDDs & Growing

Thanx will give it a try and report back here.