Considering that, most of the time, removing a file won't zeroize sectors that were once allocated to that file, this method may give you highly erroneous results. For example, if I fill an entire disk with millions of files and then remove them all, analyzing the disk as a raw device and looking for blank sectors will show zero free space.I thought there might be some way to read each sector on a disk and determine if it had been written to at some point...
You typically read the FAT (File Allocation Table) or BAM (Block Availability Map), not the actual blocks.For example, if I fill an entire disk with millions of files and then remove them all, analyzing the disk as a raw device and looking for blank sectors will show zero free space.