| <<< Advanced: Drive Size | Index | Advanced: Recovering Deleted Partition >>> |
Using info provided by Partition Entry bookmark, go to the VBR of the existing partition. In many cases this is PS 63.
The 8 bytes at VBR sector offset SO 40 will contain the size of the partition.
Highlight the 8 bytes, right-click and click Go To.... using the Little Endian selection option, observe decoded decimal value of the partition size, in sectors.
Recall that MBR partition table entry also indicates partition size. The VBR value is one-less, because last sector of NTFS partition contains a backup copy of the VBR.
EnCase treats backup copy of the VBR as Volume Slack.
| <<< Advanced: Drive Size | Index | Advanced: Recovering Deleted Partition >>> |