This question mainly aims at making sure that we use the word "unallocated" in the same manner.
Unallocated space on a partition contains sectors with data which is not any longer maintained in the file system like deleted files. In $MFT the entry would show that the file was deleted and the related sectors are unallocated. True or not?
Which would mean that index search results found in the unallocated space belong to deleted files? True or not?
And does the term "free space" in Raw Disk Search results refer to entries found in unallocatd space? or, are Free Space and Unallocated Space different objects?
Best regards
Unallocated space on a partition contains sectors with data which is not any longer maintained in the file system like deleted files. In $MFT the entry would show that the file was deleted and the related sectors are unallocated. True or not?
Which would mean that index search results found in the unallocated space belong to deleted files? True or not?
And does the term "free space" in Raw Disk Search results refer to entries found in unallocatd space? or, are Free Space and Unallocated Space different objects?
Best regards
Comment