How to determine if there are hidden partitions on a drive?

With the help of the 'Raw Disk Viewer' module in OSForensics, you can verify whether or not there are hidden partitions on your physical disk. Often, a physical hard disk is divided into partitions where one (or more) partitions are not accessible by the end user. It is often the case that computer vendors make these partitions hidden because it contains files for reverting the system back to factory state. However, hidden partitions are also a prime location for storing evidence files and other files of interest.

Select the physical disk (without a partition) in the drop-down list. This is important as the MBR and partition table are outside of the partitioned space.

Ensure the cursor is within the first sector (Sector 0) of the disk. In the Data Interpreter window, the partition table is displayed in a readable format.

Every partition on the disk is shown, regardless of whether the partition is hidden or not. Valid partitions should have a partition type, and non-zero First Sector and Total Sectors entries. In this example, there is a partition with a "Hidden FAT 32" partition type. This partition would not normally be accessible in Windows, but its contents are viewable in the raw disk viewer.

See also, How to determine if there are unallocated sectors on a drive?