Forensic Concept of Data © Dr. D. Kall Loper, all rights reserved Storage Forensics Forensic Concept of Data

Storage Forensics Definitions User Data Any data visible to the under normal operation of the system. The vast majority of evidence will be found in user data. This includes files in the ‘Recycling Bin’ or the Macintosh ‘Trash Can.’ Definitions

Storage Forensics Definitions Image An exact copy of a hard drive, including slack space, unallocated space, and the Windows™ swap file, if present. This copy is not like logical copies made with the operating system’s ‘copy’ command in that it includes all of the latent data as well as active files. Definitions © Dr. D. Kall Loper, all rights reserved

Storage Forensics Definitions Latent Data All data on a storage device that is not accessible through the operating system. This includes: Unallocated Space, File Slack Protected Files, and Virtual Memory. Definitions © Dr. D. Kall Loper, all rights reserved

Storage Forensics Definitions Unallocated Space All the clusters on a drive that are not currently assigned to a file. Definitions Access Data (2003). Forensic tool kit: User’s guide. Orem, UT: Access Data. p. 242 © Dr. D. Kall Loper, all rights reserved

Storage Forensics Definitions Sector A sector is a logical block* defined by the hard drive firmware. Prior to January 2011, and a preceding transition period, sector size was set at 512 bytes. Advanced Format Hard Disk Drives use 4096 byte sectors. A sector is a low-level formatting artifact. Definitions A logical block implies LBA (logical block addressing, but the eponymous sector was formerly used in CHS—Cylinder Head Sector—addressing). The term was sometimes synonymous with “block,” but block became associated with a variable length data run used on media beyond the hard disk drive. © Dr. D. Kall Loper, all rights reserved

Storage Forensics Definitions Cluster Fixed-length blocks that store files. Each cluster is assigned a unique number by the computer operating system. A cluster is a high-level formatting artifact. Definitions Access Data (2003). Forensic tool kit: User’s guide. Orem, UT: Access Data. p. 241 © Dr. D. Kall Loper, all rights reserved

Slack Space Illustration On this hard drive, There are 4096 bytes per cluster. There are 512 bytes per sector. Thus, there are 8 sectors per cluster. (4,096 ÷ 512 = 8) Illustration

Storage Forensics Definitions File Slack Unused space. File systems store files in fixed-length blocks called clusters. Because few files are a size that is an exact multiple of the cluster size, there is typically unused space between the end of the file and the end of the last cluster used by that file. Definitions Access Data (2003). Forensic tool kit: User’s guide. Orem, UT: Access Data. p. 241 © Dr. D. Kall Loper, all rights reserved

Storage Forensics Definitions RAM Slack RAM slack is latent data used by the operating system to ‘pad’ the end of a file to completely fill its last sector. Hard drives write one complete sector at a time. They need the padding. Definitions

Slack Space Illustration In this file, The file is 2304 bytes. Each of the first four sectors contain 512 bytes, but the file cannot fill a fifth. (512 x 4 = 2048) (2304-2048 = 256) Illustration

Slack Space Illustration In this file, The remaining 256 bytes are filled with data from the system memory: RAM. In this illustration, the file is green; the RAM slack is blue. Illustration

Slack Space Illustration In this file, The remaining space in the cluster is called file slack. In this illustration, file slack is red. Illustration

Storage Forensics Definitions Virtual Memory Virtual memory (VM) is a technique that allows a computer to use hard drive space as a form of super-slow RAM. While it is not efficient, it allows a system with insufficient memory to complete tasks and not crash when main memory runs out. The file created is called: Swap File, in Windows and Paging File, in UNIX. Definitions

Storage Forensics Virtual Memory and RAM Slack Accessing VM and RAM slack are two ways to read the contents of system memory. Active memory may hold lists of network connections (ARP cache, etc.) or indicate the way a computer was being used at the time.