One way to identify the presence of hidden partitions on a suspect's hard drive is to...

One way to identify the presence of hidden partitions on a suspect's hard drive is to...

• A. Add up the total size of all known partitions and compare it to the total size of the hard drive
• B. Examine the FAT and identify hidden partitions by noting an H in the partition Type field
• C. Examine the LILO and note an H in the partition Type field
• D. It is not possible to have hidden partitions on a hard drive

Answer: (A)

Hidden partitions can exist as unallocated or unreported space on a hard drive, and a simple way to spot them is to compare what the operating system shows with the drive’s actual capacity. By summing the sizes of all partitions you can see in the system and comparing that total to the disk’s advertised size, any gap indicates space not allocated to a visible partition. That unused space could be a hidden partition, a recovery area, or other non-displayed space uncovered by the OS. The other ideas aren’t reliable indicators. The partition type fields in FAT or other tables don’t standardly mark a hidden partition with a simple letter like “H,” and LILO is just a boot loader, not a tool for detecting hidden partitions. Also, hidden partitions can and do exist, so saying they’re not possible is incorrect.

Hidden partitions can exist as unallocated or unreported space on a hard drive, and a simple way to spot them is to compare what the operating system shows with the drive’s actual capacity. By summing the sizes of all partitions you can see in the system and comparing that total to the disk’s advertised size, any gap indicates space not allocated to a visible partition. That unused space could be a hidden partition, a recovery area, or other non-displayed space uncovered by the OS.

The other ideas aren’t reliable indicators. The partition type fields in FAT or other tables don’t standardly mark a hidden partition with a simple letter like “H,” and LILO is just a boot loader, not a tool for detecting hidden partitions. Also, hidden partitions can and do exist, so saying they’re not possible is incorrect.