1. Computer System Basics 2 Hard Drive Storage & File Partitions Computer Forensics BACS 371

2. Computer System Basics 2  Hardware  Disk Drives Formatting Data Storage File Partitions File Systems introduction

3. Hardware  Disk Drives  Formatting Low-Level Formatting High-Level Formatting  Data Storage Encoded Bit Byte Word Sector Cluster File

4. Hard Disk Drives

5. Hard Disk Drive Sectors and Clusters

6. Disk Drive & Misc Hardware Videos Details about how a hard drive works (apx 3:20) http://www.youtube.com/watch?v=kdmLvl1n82U See hard drive running and accessing (apx 1:40) http://www.youtube.com/watch?v=4sz4VHCj2Ho Why not freeze a hard drive? http://www.youtube.com/watch?v=ad1uVAB5bNA  Old 72 MB hard drive staring up. (apx 1:08) http://www.youtube.com/watch?v=Y9Z8vF46fXo  Long video disassembling a big hard drive (apx 47 min) https://www.youtube.com/watch?v=CBjoWMA5d84

7. Hard Drive Basics  Head  Device which reads and writes data on the disk  Track  Individual circles on disk platter where data are located  Cylinder  A column of tracks on a disk drive with 2 or more platters  Sector  An individual section of data on a track – the smallest amount of data which can be written to the disk – usually 512 bytes  Disk Capacity (CHS calculation) = #cylinders (platters) * #tracks * #sectors

8. Disk Addressing Schemes  There are 2 common disk addressing schemes:  CHS  Cylinder, Head, Sector  Closely tied to the physical geometry of the disk drive  LBA  Logical Block Address  Independent from the physical geometry of the disk drive  First block on disk numbered 0, next is 1, …  Most modern drives use this scheme

9. CHS Calculation Example Platter Track Sector Cylinder Capacity = Heads * Tracks * Sectors * Bytes/Sector

10. Hard Drive Data Storage I  Bit  Binary Digit  Stores either a ‘1’ or a ‘0’  Byte  8 bits  Single ASCII character  Values from 0~255  Word  Usually 4 Bytes  Represents the minimum piece of information which a computer can manipulate  Values from 0~4,294,967,296 Bit Byte Word 32 bits or 4 bytes 8 bits

11. Hard Drive Data Storage II  Sector  Minimum storage size on a hard drive  One “pie shaped” arc of a platter  Common storage size of 512 Bytes  Established during low-level formatting  Numbered sequentially starting at 1  Cluster (File Allocation Units)  Minimum storage size for a file as determined by file system  Common cluster size is 4096 Bytes (4KB) – 8 Sectors  File  Determined by file system Sectors Clusters File 2 Clusters 8 Sectors * Just an example, your file may occupy more or fewer clusters.

12. Hard Drive Storage Capacities Name Exact Amount (Bytes) Power of 10 (approx) Power of 2 (Exact) Visual Comparison KilobyteKB1024 10 3 2 10 1024 Characters – One half page of text MegabyteMB1,048,576 10 6 2 20 Small Novel 5MB = Shakespeare’s work GigabyteGB 1,073,741,8 24 10 9 2 30 Truck full of paper TerabyteTB 1,099,511,6 27,776 10 12 2 40 10TB = Massive amounts of data (small library) PetabytePB 1,125,899,9 06,842,624 10 15 2 50

13. Formatting and Partitioning  Low-Level Formatting  Physically defines tracks and sectors on disk  Does erase data  Typically only performed at factory  Partitioning  High-Level Formatting  Dividing the disk into volumes – process of defining the file system structure  Appear as logical drives to OS  Does not destroy data on Disk

14. Partitions  A partition is a logical volume within a physical volume (i.e., disk).  The Master Boot Record (MBR) of a disk defines the partitions found on the physical disk.  An MBR can define 4 primary partitions (max).  These partitions can be defined as “logical partitions.”  Logical partitions are capable of being further subdivided into smaller logical partitions.

15. Partitions To open Computer Management, click Start, and then click Control Panel. Click Performance and Maintenance, click Administrative Tools, and then double-click Computer Management.

16. Partition Table 4 Entries First Entry Starts at offset 0x01BE (446 10 ) Master Boot Record (MBR) MBR “Signature” 0x55AA Executable Code Machine Language Code Processor Specific Decodes Partition Table 446 bytes long byte 446

17. Decoding a Partition Table Entry Entry #3 starting at offset 0x01DE Bootable? Offset 0 Value 0x80 means bootable Starting Head Offset 1 1 Byte 0x00 = 0 Starting Head Starting Sector Offset 2 6 bits (use 6 LSB) Decode as bits 0xC1 = 1100|0001 6 LSB = 000001 = Sector #1 Starting Cylinder Offset 3 10 bits (use remaining 2 bits from sector as upper 2 bits) Decode as bits 0xFF = 1111|1111 10 bits = 11|1111|1111 = 0x3FF = Cylinder # 1023 File System Type Offset 4 Decode as table entry 0x0C = Win 95 Fat-32 LBA Ending Head 5 Ending Sector 6 Ending Cylinder 7 Relative Sectors ( start of partition ) Offset 8 4 Bytes Decode as Number (swap) 0x1D0D9045 = 487,428,165 # of sectors from start of drive to start of this partition Number of Sectors Offset 12 4 Bytes Decode as Number (swap) 0x000E37BA = 931,770 # of sectors in this partition 477,066,240 bytes (*512)

18. Partition Layout http://www.microsoft.com/library/media/1033/tech net/images/prodtechnol/winxppro/reskit/ch28/f28zs 07_big.jpg

19. Extended Partition Layout http://www.microsoft.com/library/media /1033/technet/images/prodtechnol/winx ppro/reskit/ch28/f28zs07_big.jpg

20. File Systems  Each partition can contain an independent file system.  A file system is merely a structure for storing and organizing computer files and data on a disk partition to make it easy to find.  The main files systems currently used are:  FAT – (FAT12, FAT16, FAT32., exFAT_  NTFS  EXT (Ext2, Ext3, Ext4)  HFS