We have a laptop that had dual boot, primary is Win 7 pro and secondary WAS Win XP, the Win 7 hard drive was installed to run modern programs etc. we kept the XP drive for older building management systems. The disgruntled technician formatted the XP hard drive wiping out everything, the only thing that is shows in windows explored is 100Mb (which I assume is for indexing) the drive shows nothing but 297 Gig of free space. Under properties there isn't any creation date. We need to find out (if possible) when the drive was formatted (volume created) to prove intent to destroy data within a certain time frame. Again it's now a blank but mountable hard drive with No operating system on it. Assuming it has a Volume # and serial # can the creation date be determined? I’m not a programmer so layman terms would be great. Thanks in advance for any possible help.

  • If this is for legal purposes then I recommend you stop using the system and shut it down immediately, then get a forensics expert to take a look at it and prepare a certified report for you. – Karan Apr 16 '15 at 0:48

if its possible grab a copy of gpart or gdisk (not gparted which is a partitionING tool) or any linux distro and locate the partiton / drive in question. (running lsblk is very helpful for this) Once known run gpart -f -d -l (some filename) {whatever it is shown as --sample syntax below assuming its in an external enclosure)

$ lsblk

[server@server ~]$ lsblk


sda 8:0 0 232.9G 0 disk

├─sda1 8:1 0 2M 0 part

├─sda2 8:2 0 518M 0 part
│ └─server.boot-boot 253:0 0 512M 0 lvm /boot

└─sda3 8:3 0 232.4G 0 part |

                                       253:1    0 232.4G  0 crypt 


sdb 8:16 0 7.5G 0 disk

(target drive would be sdb in this case)

$ gpart -b -f -l forensics-log /dev/sdb

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.