- Introduction
- Hard Disk Drives
- Cloning a PATA or SATA Hard Disk
- Removable Memory
- Summary
- Assessment
- References
This chapter is from the book
This chapter is from the book
This chapter is from the book
Hard Disk Drives
In Chapter 2, “Windows Operating and File Systems,” we discussed the components of a computer’s hard disk drive and also described how files are physically saved and retrieved. It is, however, necessary now to discuss the various types of hard disk drive interfaces that a computer forensics investigation will encounter.
Small Computer System Interface (SCSI)
Small Computer System Interface (SCSI) is a protocol for both the physical connection of devices and the transfer of data. SCSI devices can include hard disks, tape drives, scanners, and CD drives. It is important to understand that SCSI also refers to a command protocol. Larry Boucher is credited with much of the SCSI development and advances, which began at Shugart Associates. It was developed as a vendor-neutral protocol for devices and therefore enabled the same device to work on either a personal computer or on an Apple Macintosh computer. SCSI devices can also be connected to UNIX systems. The benefits of using SCSI are not limited to its compatibility with various systems; it also enables high rates of data transfer. Another tremendous advantage introduced with SCSI is that several devices can be connected in a chain to a single SCSI port.
Forensic Investigations Involving SCSI
From an investigator’s point of view, it is important to understand that there are still computers that utilize devices with SCSI connectors (see Figure 3.1). Therefore, you may need older systems in your lab to operate these devices, and you must also think about the relevant drivers that will need to be installed. SCSI hard disk interfaces are not very common today. However, there are still forensic imaging devices that can be used with SCSI hard disks. For example, the RoadMASSter 3 Mobile Computer Forensics Data Acquisition and Analysis Lab is a system that supports the SCSI interface.
)
FIGURE 3.1 SCSI connector
Integrated Drive Electronics (IDE)
Integrated Drive Electronics (IDE) is a drive interface, connector, and controller, which is largely based on IBM PC standards, for devices like hard disk drives, tape drives, and optical drives. The disk (or drive) controller is built into the drive itself. The disk controller facilitates communication between a computer’s central processing unit (CPU) and hard disks (or other disk drives). See Figure 3.2.
)
FIGURE 3.2 IDE interface on a hard disk
This interface was developed by Western Digital, and these IDE drives were first installed in Compaq computers in 1986. This initial version of IDE can be referred to as ATA/ATAPI (Advanced Technology Attachment with Packet Interface). IDE and EIDE have been retrospectively called Parallel ATA or PATA.
Western Digital later introduced Enhanced IDE (EIDE) in 1994. IDE and EIDE connectors typically have 40 pins, although there are 80-pin versions, and the cable is generally 3.5 inches wide (see Figure 3.3).
)
FIGURE 3.3 IDE 40-pin connector
Serial ATA (SATA)
Serial ATA is an interface that connects devices like hard disk drives to host bus adapters. SATA provides higher data transfer rates than Parallel ATA (PATA). SATA was introduced to the market in 2003 and largely replaced EIDE devices. A SATA drive is generally the most common hard disk drive interface that an investigator will encounter, whether it is a desktop or a laptop, or an iMac or a MacBook. Figure 3.4 shows a SATA data cable for desktop, server, and laptop computers.
){kind=link}
FIGURE 3.4 SATA data cable
The SATA power cable is a wider, 15-pin connector, distinguished by red and black wires (see Figure 3.5).
){kind=link}
SATA power cable
In some investigations, an investigator may come into contact with eSATA connections. Therefore, eSATA connectors should also be a part of the computer forensic investigator’s toolbox. eSATA is a variation of SATA that is used for external drives. See Figure 3.6.
)
FIGURE 3.6 eSATA connector
SATA disk drives come in different sizes. A 1.8-inch hard drive (see Figure 3.7) is connected to the motherboard by a ZIF connector. These significantly smaller hard drives are found in Dell D420 and Dell 430 laptops. Toshiba manufactures these hard drives for Dell. The significance for an investigator is that the ZIF cable (see Figure 3.8) and adapter are very specialized and can be difficult to source.
){kind=link}
FIGURE 3.7 1.8-inch Toshiba hard disk drive
FIGURE 3.8 ZIF cable