I'm actually trying to make my hand around forensic and information security as a whole. To do this, I'm trying to make a lot of CTFs. The last one I got to do is puzzling me, 1st because I have no experience with this and second, because I don't know how to manage data recovery.
To make things short: I got a USB dump (FAT16) which at first it looks about 1 Gb in size. I was able to recover some files from it already using autopsy and FTK Imager.
When I read the data contained in the usb drive with these softwares, I can see that there is about 900 Mb of ''unallocated space'' and when I try to look at it with the hex heditor, all bits are 0. I have 2 questions :
- Is this normal that those bits are all 0 on unallocated space?
- Is there anyway to recover the data that was there before it became unallocated?
I think this space could contain the flag I Ineed, but I can't seem to recover it. I've tried few things : Mount the drive on my computer with FTK and use tools to try to recover it, but none worked. I also tried to get a hint if there was lost data in all those 0's but I still hadn't had any luck.
From the recovered data in autopsy I have following files:
$FAT1 $FAT2 $MBR $Unalloc --- this is the space that is of interest to me .Folder File1 File2
When I open
$unalloc, I have a file in it which have a size, but all bits are set to 0 in the hexedit.