Illustrate how an investigator would detect whether a suspect's drive contains hidden partitions.

Question

What will be an ideal response?

Answer 1

Hiding partitions is a technique for concealing information.?To detect whether this technique has been used, be sure to account for all disk space when you're examining an evidence drive. Analyze any disk areas containing space you can't account for so that you can determine whether they contain additional evidence. These spaces are not accessible in File Explorer, but most digital forensics or hexadecimal editors could access it. Partition gaps are 128 bytes in Windows Vista and later, so any large gaps should be examined to see whether it contains and relevant evidence. In ProDiscover, a hidden partition appears as the highest available drive letter set in the BIOS,  other forensics tools have their own methods of assigning drive letters to hidden partitions. These assigned drive letters allow a digital forensics tool to access and examine the hidden partition.