Understand Disk Layouts & Hidden Evidence

When a digital forensics investigator images a hard drive, are they really getting everything? The answer is often no. Standard forensic tools create an image of the "user accessible" area of a disk, but hard drives have hidden places where data can reside, invisible to the operating system and conventional analysis. These areas, like the manufacturer's Service Area or sectors that have been marked as "bad" and reallocated, can contain fragments of old data or even intentionally hidden evidence.