Does anyone here have the following two pieces of information that I am
looking for? The first piece is dealing with the more indepth shutdown
process and exactly when does the regeistry get closed during that process
and the second peice is dealing with information in depth about the sectors
and clusters use. I was told that the physical sector 96 displays the hex
charature 07 when the system is not properly shut down. I would like to know
if that is true and at what was terminated before that is written to the
disk.

I am working onb a case where I believe the soon to be exwife had planted
infromation that would hurt him and the police may have lost some very
valuable information as they siezed the computer. Can anyone help?