coen 252 computer forensics hard drive geometry. drive geometry basic definitions: track sector...

COEN 252 Computer Forensics

Hard Drive Geometry

Drive Geometry

Basic Definitions: Track Sector

Floppy

Hard Drive Geometry Cylinder

Cylinder is formed by the tracks on all the platters with fixed actuator.

(Due to different temperatures and hence different arm length, it is impossible to read and write in parallel.)

Hard Drive Geometry Writing and

Reading on a Track

Hard Drive Geometry

Data is stored in the form of a magnetization pattern.

Complete Disk

IBM Ultrastar Z

Sectors

Complete Sectors are written and read.

Sectors Consists of

Inter-sector gap ID Information (including defective

mark)(no longer used in modern drives)

Synchronization fields Client Data (512B) ECC Inter-sector gap

Formatting

Low level format Creates “data structures” for tracks

and sectors. Defective sectors and regions are

remapped. There is no direct access to the disk

layout. This is not the usual formatting.

Interfaces Disks are getting smarter:

In the history of disk drives, control function moved to the disk.

Disks uses Logical Sector or Cylinder-Head-Sector addressing interface

SCSI: Small Computer Systems Interface Block Device (Logical Sector) SCSI 1, 2, 3 standards implement generic

command language ATA (AT Attachment): PATA, SATA

Interfaces ATA / IDE (Integrated Disk

Electronics) Specified as family of standards ATA-1

(1994) to ATA-7 (in draft) ATA disks require a controller

(“channel”) built into the motherboard.

Controller controls one or two disks. Master and slave disk.

Typical motherboard has two channels with up to two disks / devices.

Interfaces SATA (Serial ATA) as opposed to PATA

uses Advanced Host Controller Interface (AHCI)

supported by Vista, Linux, but not XP often implemented in conjunction with

Serial Attached SCSI (SAS) look like PATA at the application level

but completely non-interchangeable at the device level

7 pin SATA data cable

15 pin SATA power cable

Interfaces Addressing

Distinguish Physical addresses (low level format) and Logical addresses (changed by normal

formatting / repartitioning) Physical addresses

Cylinder Head Sector proved to limiting: 10b cylinder, 4b head, 6b sector 16b cylinder, 4b head, 6b sector

LBA (Logical Block Addresses) In older systems, the BIOS might have to do

address translation. This causes a FE (forensic examiner) head-ache if

disks are mounted on other systems.

Interfaces

Terminology is difficult to understand.

http://www.pcguide.com/ref/hdd/if/ide

Removable media specifications in AT Attachment Packet Interface

(ATAPI)

Interfaces Controller issues commands over

the ribbon cable. Single bit determines whether the

master or the slave executes the command.

Controller writes to command register.

Disk responds by writing to status register.

Interfaces Hard Drive Passwords

Established in ATA-3. Set through BIOS or through software. If implemented:

User password Master password (for organization) High-security: both passwords unlock

disk. Maximum-security: master password only

unlocks after disk drive has been wiped.

Interfaces Hard Drive Passwords

Locked disk is usually visible to the OS.

Need SECURITY_UNLOCK with the correct password before most ATA commands are executed.

There are tools (hdunlock, atapwd) to unlock a drive

Used mainly to circumvent IP protection in game consoles (X-box)

Host Protected Area: HPA

Appeared first in ATA-4 Used so that computer vendors

could store data that a user cannot damage by formatting.

HPA can be used to hide data.

Host Protected Area: HPA Investigative Process

READ_NATIVE_MAX_ADDRESS returns number of physical sectors

IDENTIFY_DEVICE returns number of sectors that a user can access.

Difference shows existence and extend of HPA. Creating HPA

SET_MAX_ADDRESS limits user access to last sectors. Rerunning it with maximum physical address unlocks

HPA. Volatility bit determines whether HPA exists after the

disk is shut down and restarted. This can be used to temporarily unlock a HPA.

DCODevice Configuration Overlay ATA-6 Limits the apparent maximum number

of physical sectors. Use the DEVICE_CONFIGURATION_SET /

RESET ATA commands.

Interface

PATA vs. SATA SATA has speed advantage and also

smaller cable.