I have been given an HDD image. I believe the image was taken with dd. I have ingested the file using Autopsy and can see there are 4 volumes, like so
- Volume 1 - Unallocated. I believe NOT securely deleted
- Volume 2 - NTFS / exFAT. Windows Vista, not deleted
- Volume 3 - DOS FAT 12. Not deleted.
- Volume 4 - Unallocated
I would like to know how (if possible), to recover Volume 1 so that I can mount the image in a Virtual Machine. I would also like to recover Volume 4.
Note: I have access to Windows and Linux to perform this analysis.