Chapter 05 - Notes and Definitions

Three current versions of FAT

FAT16, FAT32, and exFAT (used for personal storage devices)

Three older FAT formats are

FATX, Virtual FAT (VFAT) and FAT12

The partition table is in the

MBR (master boot record), located at sector 0 of the disk drive.

For Fat32 file systems, cluster sizes are determined by

The OS. Clusters can range from 1 sector consisting of 512 bytes to 128 sectors of 64KB

RAM Slack

The unused space between the end of the file (EOF) and the end of the last sector used by the active file in the cluster. Any data residing in RAM at the time the file is saved, such as logon IDs and passwords, can appear in this area, whether the information was saved or not. RAM slack is found primarily in older Microsoft OSs.

File Slack

The unused space created when a file is saved. If the allocated space is larger than the file, the remaining space is slack space and can contain passwords, logon IDs, file fragments, and deleted e-mails.

Test the feature with a

USB drive easily by copying data to t, deleting it, and then making a forensic acquisition with any acquisition tool such as OSForensics or X-Ways Forensics immediately after the data is deleted

Some instances you might need to identify the OS on an unknown disk

Use WinHex or another hexadecimal editor

Logical addresses

When files are saved, they are assigned to clusters, which the OS numbers sequentially starting at 2. Logical addresses point to relative cluster positions, using these assigned cluster numbers. EXAMPLE: custer address 100 is 98 clusters from cluster address 2.

Manufacturer engineers a disk to have

a certain number of sectors per track and typically a disk drive stores 512 bytes per sector.

If data is hidden in this partition gap

a disk editor utility could be use to access it.

Microsoft OSs

allocates disk space for files by clusters, this practice results in drive slack

Wear Leveling

an internal firmware feature used in solid state drives that ensures even wear of read/writes for all memory cells

Tracks

are concentric circles on a disk platter where data is located

Other disk properties such as ZBR, track density, areal density, and head and cylinder skew

are handled at the drive's hardware or firmware level

Disk drives

are made up of one or more platters coated with magnetic material, and data is stored on platters in a particular way.

Clusters

are storage allocation units of one or more sectors. They range from 512 bytes up to 32,000 bytes each.

When OS stores data in a FAT file system it

assigns a starting cluster position to a file. Data for the file is written to the first sector of the first assigned cluster. When this first cluster is filled and runs out of room, FAT assigns the next available cluster to the file. If next cluster isn't contiguous to the current cluster, the file becomes fragmented.

Another technique to hide incriminating digital evidence at the end of a disk

by declaring a smaller number of bytes than the actual drive size. with disk editing tools, you can access these hidden or empty areas of the disk

Partitions containing unused space

can be created between the primary partitions or logical partitions

Someone who wants to hide data on a hard disk

can create hidden partitions or voids - large unused gaps between partitions on a disk drive

In Microsoft file structures, sectors are grouped to form

clusters

CMOS

computer stores system configuration and date and time information in _____

First sector of all disks

contains a system area, the boot record, and a file structure database.

BIOS & EFI

contains programs that perform input and output at the hardware level. Are designed for specific firmware.

Typically, chained clusters are

contiguous on disk. However some files are created and deleted and other files are expanded, the chan can be broken or fragmented.

It's possible to

create a partition, add data to it, and then remove references to the partition so that it can be hidden in Windows.

USB and other solid state drives systems are different

in that memory cells shift data at the physical level to other cells that have fewer reads and writes continuously.

All SSDS have an

internal power source for memory cells (both allocated and unallocated) so they can preserve data

Cylinders

is a column of tracks on two or more disk platters. Typically, each platter has two surfaces: top and bottom

Partition

is a logical drive on a disk. It can be the entire disk or part of the disk

Zone bit recording

is a method most manufacturers use to deal with a platter's inner tracks being shorter than the outer tracks. Grouping tracks by zones ensures that all tracks hold the same amount of data

Sector

is a section on a track, usually made up of 512 bytes.

Drive Slack

is composed of the unused space in a cluster between the end of an active file's content and the end of the cluster. It includes RAM slack(found mainly in older Microsoft OSs) and file slack.

EFI

is designed for x64 computers and GPT formatted disks

Head

is the device that reads and writes data to a drive. There are two heads per platter that read write the top and bottom sides

File Allocation Table (FAT)

is the original Microsoft file structure database designed for floppy disks. It's used to organize files on a disk so that the OS can find the files it needs. Variots are FAT12, FAT16, FAT32, VFAT, and FATX

Track density

is the space between tracks on a disk. The smaller the space between tracks, the more tracks on a disk. Older drives with wider track densities allowed the heads to wander.

Purpose of shifting (rotating) data from one memory cell to another

is to make sure all memory cells on the flash drive wear evenly.

One way to examine a partitions physical level

is to use a disk editor; WinHex or Hex Workshop tools enable you to view file headers and other critical parts of a file. both involve analyzing key hexadecimal codes the OS use to identify and maintain file system

Partition gap

is unused space or void between the first primary partition and the first logical partition

If you make another acquisition of the USB drive a day or more later

it reveals that the previously recoverable deleted data no longer exists.

The OS assigns these cluster numbers referred to as

logical addresses

When dealing with SSD

make a full forensic copy asap as it's crucial in case you need to recover data from unallocated disk space

Subject computer starts

make sure t boots to a forensically configured CD, DVD, or USB drive because booting to the hard disk overwrites and changes evidentiary data. to do this, access CMOS setup by monitoring the computer during the bootstrap process to identify correct key/keys to use.

Combining sectors

minimizes the overhead of writing or reading files to a disk.

To determine total number of addressable bytes on a disk

multiply the number of cylinders by the number of heads (actually tracks) and by the number of sectors (groups of 512 or more bytes). this formula is is "cylinder, head, and sector (CHS) calculation"

Areal density

number of bits per square inch of a disk platter - this number includes the unused space between tracks

MBR (master boot record)

on windows and DOS computers, the boot disk file contains information about partitions on a disk and their locations, size, and other important items

The OS groups

one or more sectors into a cluster

When data is deleted on a hard drive

only references to it are removed, which leaves original data in unallocated disk space

Many hard disks are

partitioned, or divided into two or more sections

Memory cells are designed to

perform 10,000 to 100,000 reads/writes, depending on manufacturer. When that limit is reached, they can no longer retain data

Sector numbers are referred to as

physical addresses

First acquisition

produces recoverable artifacts

Geometry

refers to a disk's logical structure of platters, tracks and sectors

Safe method to verify BIOS

remove all hard drive from computer, enables you to start the computer to verify its BIOS data and time without accessing the disk drive

Clusters are numbered

sequentially, starting at 0 in NFTS and 2 in FAT

Tracks also allowing a numbering scheme

start from 0 (first value of computing). So if a disk lists 79 tracks, you actually have 80 tracks, 0 to 79.

Unintentional side effect of FAT16 allowing large clusters was

that it reduced fragmentation as cluster size increased.

When you run out of room for allocated cluster,

the OS allocates another cluster for your file. As files grow and require more disk space, assigned clusters are chained together.

Physical addresses

the actual sectors in which files are located. Sectors reside at the hardware and firmware level. They also go from address 0 (the first sector on the disk) to the last sector on the disk

In addition, when data is rotated to another memory cell

the old memory cell addresses are listed in a firmware file called a "garbage collector" some point, the flash drive's firmware erases data in unallocated cells by overwriting the value of 1 in all cells listed in the garbage collector file

Unused space between partitions is called

the partition gap

Windows OSs can have

three primary partitions followed by an extended partition that can contain one or more logical drives.

FAt16

to handle larger disks, Microsoft develop FAT16, which is still used on older MicroOSs such as MS-DOS 3.0 through 6.22, windows 95 (1st release) and Windows NT 3.5 and 4.0 FAT16 supports disk partitions with a maximum storage capacity of 4 GB

Flash memory stoage

used in USB drives, laptops, tablets, and cell phones can be a challenge because if deleted data isn't recovered immediately it might be lost forever. REASON: all flash memory devices have wear leveling

The number of sectors in aa cluster

varies according to disk size. Example: a double sided floppy disk has one sector per cluster; a hard disk has four or more sectors per cluster

FAT12

version is used for floppy disks mainly, has limited amount of storage space. Was originally designed for MS-DOS 1.0 (first Microsoft OS used for floppy disk drives and drives up to 16 MB)

If you let USB drive sit and write no additional data to it

wear leveling automatically overwrites the unallocated space

FAT32

when disk tech improved and disks larger than 2Gb were developed, Microsoft released FAt32 which can access larger drives

Clusters and their address are specific to a logical disk drive

which is a disk partition

Bookstrap process

which is contained in ROM, tells computer how to proceed

With tools such as WinHex

you can also identify file headers to determine the file types with or without an extension

In hexadecimal editor such as WinHex

you can find the first partition starting at offset 0x1BE second partition starts at 0x1CE third starts at 0x1DE fourth 0x1EE

When attempting to connect the device

you will get an access failure message, the process is controlled on the flash device's firmware

Other OSs such as Linux and Macintosh can

format, read and write to FAT storage devices such as USB drives and SD cards

Head and Cylinder Skew

A method manufacturers use to minimize lag time. The starting sectors of tracks are slightly offset from each other to move the read-write head.

File system

gives an OS a road map to data on a disk. The type of file system an OS uses determines how data is stored on the disk.

FAT version in Microsoft DOS 6.22

had a limitation of 8 characters for filenames and three characters for extensions

Cluster sizes vary according to

hard disk size and file system.

To make sure you don't contaminate or alter data on a suspect's system you must know

how to access and modify CMOS. BIOS, EFI, and UEFI settings

Key to access CMOS

depends on computer's BIOS. Keys: Delete, Ctrl+Alt+Insert, Ctrl+A, Ctrl+S, Ctrl+F1, F2, or F10.

BIOS

designed for x86 computers and typically used on disk drives with MBRs.

UEFI

developed by Intel, defines the interface between a computer's firmware and the OS.

exFAT

developed for mobile personal storage devices such as flash memory devices, secure digital eXtended capacity (SDCX) and memory sticks. The exFat file system can store very large files such as digital images, video, and audio files.

VFAT

developed to handle files with more than 8-character filenames and three character extensions; introduced with Windows 95. VFAT is an extension of other FAT file systems.

For mobile devices forensics

feature is important, especially if a suspect deleted relevant messages, for example, just before the device was seized and taken into evidence