Since foremost/sleuthkit seem to require a disk image, I created one using clonezilla. However, I realized afterwards that it "saves and restores only used blocks in the harddisk".
Does that mean it won't save any blocks were files used to be, but have been deleted? Or will it still copy all sectors with some sort of data on them? i.e. should I still be able to find any deleted files on the clonezilla image or not?
(related questions: How else can I create a full disk image for deleted file recovery? Can I use Sleuthkit/Foremost directly on a physical disk?)
dd
.