Storage Device Notes

Storage Media

In general, mass storage technologies are grouped into three broad categories:

• Magnetic Media (Hard Disks and Tapes)
• Non-volatile memory (flash)
• Optical media

Various HDD Forms

Length of the drive

• 3.5"
• 2.5"
• 1.8"

Different types of drives (will mostly be seeing SATA)

"SCSI" - Small Computer System Interface

• AKA Scuzzy
• Lots of different form factors
• Pin based

Some of them use "molex" power

PATA and IDE Interface

• 40 position connector; 39 pin interface
• IDE Drive jumper options - Master, Slave, Cable select (Note original jumper setting prior to image)
• Standard power connector
• "IDE" - Integrated Drive Electronics (aka PATA)

SATA - Serial Advanced Technology Attachment

SAS - Serial Attached SCSI

They look the same!

Speeds

Disk Drive Basics

Where does data reside?

Disk Platter - round flat magnetic or ceramic discs in a hard drive that holds the actual data

Made of two materials

• Substrate material
• Magnetic media coating

Disk platter organization

• Each platter has two sides
• A hard drive can have multiple platters

Track

Concentric circles where all the information is stored

• Modern disks contain 10k+ tracks
• Each platter within a hard drive will have the same amount of tracks

Cylinder

A group of tracks in a hard drive that can be accesses at the time time by the read/write head

• Typically we refer to cylinder and not the track number

Disk Drive Terminology

Number of cylinders (tracks), heads (sides) and sectors (aka CHS) uniquely identify the physical geometry of the storage units on a disk

CHS also yields disk capacity:

• Capacity = Cylinders x Heads x Sectotrs x sector_size

Logical Block Addresses (LBA)

Calculating Disk Capacity

• Odd heads because one is only accessible from one side (top or the bottom)

Where does the data reside?

Why more than one platter?

• More storage!

As more platters are added to the fixed HDD space, the gaps between each disk decreases

• More susceptible to vibrations and platter surface imperfections

The trend has been to decrease the number of platters by increasing the area density on each

Sectors

A physical unit of hard drive data storage

• A "bucket" to store parts of a file into
• Typically 512 bytes in size + some additional bytes for internal drive control
• 1 sector = 4096 (4K) bytes for new disks

• info

• ID Information - Sector # and status (good/bad)
• Synchronization fields - helps drive controller guide the read process
• ECC - Error correcting code that ensures data integrity

Bad Sectors

Areas of the platter that are damaged and not useable

Caused by

• Excessive read/writes
• certain viruses
• sudden voltage surges

The process of identifying bad sectors is defect mapping

Modern hard drives will have a pool of reserved sectors to pull from when one fails

• Called Spare Sectoring

When Bad Sectors are identified, they can not easily be seen by any operating system

• Typically hardware devices such as the PC-3000 is required

File Fragmentation

Increases seek time

SSDs - Solid State Drives

Advantages of SSD over HD

• Constant seek time (even for random access)
• File fragmentation not an issue!
• No moving parts, shake all you want! - No mechanical failure problems, fast startup time, no motor noise
• Lighter in weight
• Low power

Problem Areas

• Overwriting process is complicated and expensive (read-erase-modify-write cycle)
• Cells have limited life cycles - wear leveling must be used
• Data recovery issues
• Data carving issues
• Power faults can cause data loss or worse, a bricked device

SSD Internals

• Flash based storage (NAND flash)
• Controller

Data storage

• Data is written in blocks and pages
• Mapping to LBA (sectors) is maintained

• This graphic is slightly wrong - something to do with the sizing
• Smallest unit is section, in the page

Erasing and Writing Amplification

Write is fast

• But rewrite/overwrite involves additional erasing step
• Entire blocks (not pages or sections) must be erased

The TRIM command

Full deletion on a normal HDD

• File is marked as deleted in the file system's database
• HDD has no clue which sectors are freed up

SSDs need to know this info... Modern OS have support for this command

• Windows 7+
• Mac OSX 10.6.8+
• Android 4.3+
• Linux kernel 2.6.28+

Over-provisioning

Individual memory cells have limited read/write cycles

• Few thousand cycles (5000-50000)

Like hard disks

• SSDs have extra capacity not accessible by normal users

Unlike hard disks

• Approx. 10-25% more storage than states capacity
• Overprovisioned areas are continuously used

Forensics

Imaging (forensic data copy) issues?

• Timing - will have to be faster with an SSD
• Physical damage - need to be super careful physically with hard drive, power issues are a problem for SSDs

Access to deleted files?

Built in encryption?

• Hardware encryption - built in
• Most SSDs are self encrypting, HDDs are self encrypting
• Most phones and laptops will have it set up by the manufacturer

Unpartitioned - Free space, cannot be accessed

Unallocated partition - space in a partition that is not being used

Slack space - at the block level. Unit is occupied but it doesnt fill the whole space