Im still unsure the harddrives are secured into forensic images? and not just a logical copy?
If the harddrives has been imaged byte for byte, you would be able to search in the unallocated area too.
 
Since we're talking about a wallet.dat from 2010, what i've read is that the header should not be encrypted, so it should be possible to search for a specific header, with regular expression for all the volume, including the unallocated area.

Take a look at this topic for inspiration:
https://bitcointalk.org/index.php?topic=2857580.0