How can I recover an unallocated sector?
To recover an unallocated cluster, open Raw Disk Viewer in OSForensics.
Right click in hex view, then select "Select Range...". A window should appear where you can input the range of the unallocated sector you have identified and then click OK.
![]()
In hex view, your range has been selected. Right click again and select "Carve Selection..." and a prompt will open to allow you to save the selection to a file.
![]()
In addition, there is also a automatic file carving feature based on file signatures in the Deleted Files Search module.