Dear All and especially those who deal with forensics procedures,

In which way can we determine at which dates was a hard drive formatted?

Is there such information stored in the partition table and if yes how can we extract it?

Any help would be greatly appreciated.

Thank you.

I believe Winhex can do this (am quite sure but cannot download and check now)

Clarification, generally the day the drive was formatted the first entry of the MFT / the MFT itself will be timestamped with that date and time, but this can only be assumed accurate if the correct date and time were set in BOIS and also if there is no fear of tampering.

It also, may not show any timestamps at all. It will all depends on "HOW" it was formatted or deleted... Average user format or deletion within the Windows should show up in the regular forensic exam process!!!

Good Luck!