topic 14 - digital forensics

Question 1

what are the components of a hard disk drive (HDD)?

Answer 1

casing
platter
head
head motor
controller/cache
platter motor

hard disk drive structure = tracks, sectors and clusters.

Question 2

what is a hard disks operation?

Answer 2

Each rotating disk (platter) is made up of a thin layer of magnetically responsive material in which the data is stored (as binary).

Platters spin extremely fast 3,600-12,000 rpm.

Head glides on cushion of air cause by spin of platter (millionths of inch above).

Side to side movement of the head arm allows any position on the disk to be read/written.

Question 3

what is a sector?

Answer 3

A sector is the smallest addressable area on a hard disk (512 bytes).

One or more whole (4 sector) clusters allocated to a file (non-contiguous => fragmented file).

Question 4

what happens when a file is deleted?

Answer 4

User deletes file -> goes to recycle bin

When the recycle bin is emptied the OS marks that area of the hdisk available for reuse (unallocated space).

Question 5

how are deleted files still available after they’ve been deleted?

Answer 5

Deleted files still accessible by forensic tools UNTIL OVERWRITTEN.

Formatting deletes pointers to files locations but does not remove the data either

Secure deletion involves purposely overwriting unallocated space with random characters

Question 6

what practical tools do the forensic team use digitally?

Answer 6

• WinHex
• Windows Explorer
  Hidden files
  Deleted files
  Normal files
• FTK Imager – Preview/Image
  Write Blocker
  Write Protect USB Devices in Windows XP.
  file recovery.

Question 7

how are files generally identified?

Answer 7

Files are generally identified by their 3 character extensions. like pdf or doc or ppt.

The computer will usually try to use that extension to associate an application with the file, and then open it.

Question 8

what are file signatures and how are they used?

Answer 8

In the case of some file types, all files of that type have a known and recognisable header.

Definite indicator of content (extensions can be changed).

Known as a “file signature”.

Used by forensic tools to identify and classify files by content (and identify mismatches).