1. COEN 252: Computer Forensics
Hard Drive Evidence

2. Disk Overview
Hard Drives
Removable Devices

3. Hard Drive Overview
Data is stored in sectors of 512B, sectors are completely written and read.
Data stays, unless it is overwritten.

4. Hard Drive Sources of Evidence
Current Files
Look for access times and other metadata

5. Hard Drive Sources of Evidence
Contained in deleted files, that have not yet been completely overwritten.

6. Hard Drive Sources of Evidence
Small portions of memory written to disk with the end of a file.

7. Hard Drive Sources of Evidence
Contained in various metadata associated with the file system or the disk partitioning

8. Hard Drive Sources of Evidence
Data that has been deliberatively hidden.