1. Thursday April 19, 2018
(Discussion – Storing and Retrieving Data, Processing the Electronic Crime Scene)

2. What is a hard disk drive (HDD)?
The Daily CSI
Thursday, 4/19/18
1/1
What is a hard disk drive (HDD)?
A hard disk drive is typically the primary location of data storage within the computer. B A C

3. Remediation for Quiz 15 ends tomorrow at 5:00!
Announcements
Remediation for Quiz 15 ends tomorrow at 5:00!

4. 3/29 N/A 4/6 4/9 4/12 QUIZ 15 4/13 4/16 4/18 Assignment F5 Tomorrow F6
Summative or Formative #
Date Issued
Gone Missing Day
Last Day Accepted
XC Current Events Crossword F5
3/29
N/A
Tomorrow
eResearch Paper – The Forensics of Document Examination F6
4/6
LAB – Paper Chromatography of Inks F7
4/9
eResearch Paper - Alterations, Erasures, Obliterations F8
4/12
QUIZ 15 S4
4/13
Forensics Files – Internal Affair F1
4/16
WS – Dennis Rader, Input to Output: How Does the Computer Work? F2
4/18
Hold for eResearch Paper

5. Computer Forensics (Part 2)
Storing and Retrieving Data
Computer Forensics (Part 2)

6. Storing and Retrieving Data
Vocabulary
Storing and Retrieving Data
operating system (OS)
formatting
file allocation table
track
sector
cluster

7. Storing and Retrieving Data
The computer’s operating system (OS) is the bridge between the human user and the computer’s electronic components.
It provides the user with a working environment and facilitates interaction with the system’s components.

8. Storing and Retrieving Data
Formatting is the process of preparing a hard disk drive to store and retrieve data in its current form.

9. Storing and Retrieving Data
A disk drive track is a circular path on the surface of a disk or diskette on which information is magnetically recorded and from which recorded information is read.
A sector is the smallest unit of data that a hard drive can address.
A cluster usually is the minimum space allocated to a file.
Clusters are groups of sectors.

10. Storing and Retrieving Data
A FAT is a file allocation table.
It tracks the locations of files and folders on the hard disk drive.

11. Summary Questions What is a computer’s “operating system (OS)?”
A computer’s OS provides the user with a working environment and facilitates interaction with the system’s components.
What is “formatting?”
Formatting is the process of preparing a hard disk drive to store and retrieve data in its current form.

12. Summary Questions
In regards to computer hard disk drive structure, describe the relationship between tracks, sectors and clusters.
A disk drive track is a circular path on the surface of a disk or diskette on which information is magnetically recorded and from which recorded information is read.
A sector is the smallest unit of data that a hard drive can address.
A cluster usually is the minimum space allocated to a file.
Clusters are groups of sectors.

13. Summary Questions What is a “FAT”, and what is its purpose?
A File Allocation Table tracks the locations of files and folders on the hard disk drive.

14. Processing the Electronic Crime Scene
Aspects of a computer that should be photographed close up at an electronic crime scene include:
the screen of any running computer monitor.
all the connections to the main system unit, such as peripheral devices (keyboard, monitor, speakers, mouse, etc.)
equipment serial numbers

15. Processing the Electronic Crime Scene
Two situations in which an investigator would not unplug a computer at an electronic crime scene are:
if encryption is being used and pulling the plug would encrypt the data, rendering it unreadable without a password or key. Encryption is the process of encoding messages or information in such a way that only authorized parties can read it.
if data exists in RAM that has not been saved to HDD and will be lost if power to the system is discontinued.

16. Processing the Electronic Crime Scene
The primary goal of obtaining data from a HDD is to do so without altering even one bit of data.
To this end, a Message Digest 5 (MD5)/Secure Hash Algorithm (SHA) takes a “fingerprint” of a hard disk drive before and after forensic imaging.

17. Questions the screen of any running computer monitor
What aspects of a computer should be photographed close up at an electronic crime scene?
the screen of any running computer monitor
all the connections to the main system unit, such as keyboards, monitors, speakers, mice, etc.
equipment serial numbers

18. Questions
Name two situations in which an investigator would not immediately unplug a computer at an electronic crime scene.
if encryption is being used and “pulling the plug” will encrypt the data, rendering it unreadable without a password or key
if data exists in RAM that has not been saved to the HDD, and will thus be lost if the power is turned off

19. Questions What is the primary goal of obtaining data from a HDD?
to do so without altering even one bit of data

20. Questions
What is the purpose of a Message Digest 5/Secure Hash Algorithm (MD5/SHA)? Why would a forensic computer examiner run such an algorithm?
A MD5/SHA “fingerprints” a HDD before and after forensic imaging to demonstrate that the forensic image recovered is all-inclusive of the original contents and that nothing was altered in the process

21. Storing and Retrieving Data Processing the Electronic Crime Scene
Pop Quiz
Storing and Retrieving Data
Processing the Electronic Crime Scene