Storage Device Notes
In general, mass storage technologies are grouped into three broad categories:
- Magnetic Media (Hard Disks and Tapes)
- Non-volatile memory (flash)
- Optical media
Various HDD Forms
Length of the drive
- 3.5"
- 2.5"
- 1.8"
Different types of drives (will mostly be seeing SATA)
"SCSI" - Small Computer System Interface
- AKA Scuzzy
- Lots of different form factors
- Pin based
Some of them use "molex" power
- 40 position connector; 39 pin interface
- IDE Drive jumper options - Master, Slave, Cable select (Note original jumper setting prior to image)
- Standard power connector
- "IDE" - Integrated Drive Electronics (aka PATA)
SATA - Serial Advanced Technology Attachment
SAS - Serial Attached SCSI
They look the same!
Disk Platter - round flat magnetic or ceramic discs in a hard drive that holds the actual data
Made of two materials
- Substrate material
- Magnetic media coating
Disk platter organization
- Each platter has two sides
- A hard drive can have multiple platters
Concentric circles where all the information is stored
- Modern disks contain 10k+ tracks
- Each platter within a hard drive will have the same amount of tracks
A group of tracks in a hard drive that can be accesses at the time time by the read/write head
- Typically we refer to cylinder and not the track number
Number of cylinders (tracks), heads (sides) and sectors (aka CHS) uniquely identify the physical geometry of the storage units on a disk
CHS also yields disk capacity:
- Capacity = Cylinders x Heads x Sectotrs x sector_size
Logical Block Addresses (LBA)
- Odd heads because one is only accessible from one side (top or the bottom)
Why more than one platter?
- More storage!
As more platters are added to the fixed HDD space, the gaps between each disk decreases
- More susceptible to vibrations and platter surface imperfections
The trend has been to decrease the number of platters by increasing the area density on each
A physical unit of hard drive data storage
- A "bucket" to store parts of a file into
- Typically 512 bytes in size + some additional bytes for internal drive control
- 1 sector = 4096 (4K) bytes for new disks
- info
- ID Information - Sector # and status (good/bad)
- Synchronization fields - helps drive controller guide the read process
- ECC - Error correcting code that ensures data integrity
Areas of the platter that are damaged and not useable
Caused by
- Excessive read/writes
- certain viruses
- sudden voltage surges
The process of identifying bad sectors is defect mapping
Modern hard drives will have a pool of reserved sectors to pull from when one fails
- Called Spare Sectoring
When Bad Sectors are identified, they can not easily be seen by any operating system
- Typically hardware devices such as the PC-3000 is required
Increases seek time
- Constant seek time (even for random access)
- File fragmentation not an issue!
- No moving parts, shake all you want! - No mechanical failure problems, fast startup time, no motor noise
- Lighter in weight
- Low power
- Overwriting process is complicated and expensive (read-erase-modify-write cycle)
- Cells have limited life cycles - wear leveling must be used
- Data recovery issues
- Data carving issues
- Power faults can cause data loss or worse, a bricked device
- Flash based storage (NAND flash)
- Controller
- Data is written in blocks and pages
- Mapping to LBA (sectors) is maintained
- This graphic is slightly wrong - something to do with the sizing
- Smallest unit is section, in the page
Write is fast
- But rewrite/overwrite involves additional erasing step
- Entire blocks (not pages or sections) must be erased
Full deletion on a normal HDD
- File is marked as deleted in the file system's database
- HDD has no clue which sectors are freed up
SSDs need to know this info... Modern OS have support for this command
- Windows 7+
- Mac OSX 10.6.8+
- Android 4.3+
- Linux kernel 2.6.28+
Individual memory cells have limited read/write cycles
- Few thousand cycles (5000-50000)
Like hard disks
- SSDs have extra capacity not accessible by normal users
Unlike hard disks
- Approx. 10-25% more storage than states capacity
- Overprovisioned areas are continuously used
Imaging (forensic data copy) issues?
- Timing - will have to be faster with an SSD
- Physical damage - need to be super careful physically with hard drive, power issues are a problem for SSDs
Access to deleted files?
Built in encryption?
- Hardware encryption - built in
- Most SSDs are self encrypting, HDDs are self encrypting
- Most phones and laptops will have it set up by the manufacturer
Unpartitioned - Free space, cannot be accessed
Unallocated partition - space in a partition that is not being used
Slack space - at the block level. Unit is occupied but it doesnt fill the whole space
