Thursday, 7 April 2011
Got any older?
Friday, 2 July 2010
Our first local 'dead' hard disk acquisition
We've imaged lots of removable media over the past year (~ 400, according to Victoria's stats), and I've also done a fair amount of forensic imaging of material on-site with donors (live acquisition) . One aspect of our 'forensic' armoury that has not been subject to so much testing is the imaging of whole hard disks at BEAM. So-called 'dead' acquisitions. In the past few months two new accessions have presented us with an additional four hard disks. This is excellent news, as I have finally had the chance to use our forensic computer's Ultrabay (write-blocking device) to image a real 'collection hard disk'. Everything went smoothly. So far so good.
Monday, 15 March 2010
Media Recognition - Hard Disk Drive part 3
| Type: | Magnetic storage media |
| Introduced: | 2004 |
| Active: | Yes [2010] |
| Cessation: | - |
| Capacity: | Varies, but majority do not exceed 300GB |
| Compatibility: | Compatible with all operating systems, though drives with a capacity of 137GB or more are only compatible with Windows 98 onwards and Mac OS 10.2 onwards. Not found on 8” or 5.25” drives. |
| Users: | Servers and high-end computers |
| File Systems: | FAT, NTFS, HFS/+, ext |
| Common manufacturers: | Western Digital, Seagate, Toshiba, |
Recognition
SAS was born out of SCSI developments and entered the market in 2004. One feature making it preferable to SCSI is its higher transfer rate. Its fast speeds and high level performance make it suitable for high-end personal computer hard drives and servers. The first version was slower than the latest version of SCSI having a data transfer rate of 300 MB/s. However, in 2009 this rate increased to 600 MB/s and it is expected to reach 1200 MB/s by 2012. SAS uses point-to-point topology to connect the interface and can support multiple devices (up to 200), making it popular with servers. For the same reasons SAS hard disk drives are relatively expensive therefore they are not as common on standard personal computers as the more general purpose SATA interface.
External Hard Disk Drives
Early Apple Macintosh computers used external SCSI hard disk drives, despite internal hard disk drives being the standard for other PCs. More recently external hard drives are primarily used as additional storage devices.
FireWire (IEEE 1394): First released in 1995 this was originally developed as a replacement for the SCSI connector and many computers since 2003 have a built-in FireWire port, particularly Apple machines. FireWire has a higher transfer rate than USB and the latest version, FireWire 3200 has a rate of 393 MB/s, which also exceeds that of eSATA, although this rate varies with Windows OS. However it is more expensive than USB, hence it has never superseded USB’s popularity. It is compatible with Windows OS from Windows XP onwards, though issues with
There have been several versions of FireWire each using different connectors. Here is a brief table setting this out:
| Version | Cable Used | Date Introduced |
| FireWire 400 (IEEE 1394) | 6-circuit | 1995 |
| FireWire 400 (IEEE 1394a) | 4-circuit | 2000 |
| FireWire 800 (IEEE 1394b) | 9-circuit | 2002 |
| FireWire S3200 | 9-circuit | 2007 |
It is most common to find 6-cicuit connectors on desktop computers and 4-cicuit connectors on laptops. However, in 2000 amendments were made and the 4-cicuit connector was standardised resulting in more of these connectors being found on desktop computers.
USB (Universal Serial Bus): USB was introduced in 1996 and has since become the dominant means to connect computer peripherals to the host controller. The original USB 1.0 has a transfer rate of 12 Mbits/s, which was increased to 60 MB/s (480 Mbits/s) by USB 2.0. This was released in 2000 and standardised in 2001. Like FireWire, USB connectors carry power as well as data, therefore do not require additional power cables.
eSATA: This is SATA’s own external connector introduced in 2004 with a transfer rate of 131 MB/s. Despite having a much larger data transfer rate, few computers have eSATA ports, favouring instead USB and FireWire.
Media Recognition - Hard Disk Drives part 2
AT Attachment (ATA) Interface
| Type: | Magnetic disk storage |
| Introduced: | 1986 |
| Active: | Only on existing computers |
| Cessation: | Almost completely superseded by SATA by 2007 |
| Capacity: | 750 GB |
| Compatibility: | Compatible with all operating systems, though drives with a capacity of 137GB or more are only compatible with Windows 98 onwards and Mac OS 10.2 onwards. |
| Users: | Desktop and laptop computers, particularly low-end ones. The primary interface used by IBM and adopted by Apple in 1994. |
| File Systems: | FAT, NTFS, HFS/+, CP/M, ext, MFS |
| Common manufacturers: | Present: Western Digital, Seagate, Toshiba, Past: IMB, Apple, Sony, Hewell-Packard, Maxtor |
Recognition
ATA, designed in 1986 was an evolved form of Western Digital’s original Integrated Drive Electronics (IDE). It was used for desktop and laptop computers. After the development of SATA in 2003 ATA became retroactively known as Parallel ATA (PATA).
The first ATA hard disk drive was used in the Compaq Deskpro 386. It had a transfer rate of 16 MB/s and a capacity of 128 GB. Later versions had larger transfer rates, though none exceeded 80 MB/s until 2005. Before the advent of SATA, ATA hard disk drives were popular with IBM PCs due to their low cost. ATA drives are also found on post-1994 low-end Apple Microsystems, the first being the Apple Quadra 630. In 1997 Apple also adopted ATA for their high-end machines starting with the Apple Powerbook G3. The ATA connector has a relatively short cable so ATA hard disk drives are commonly inbuilt.
Serial ATA (SATA) Interface
| Type: | Magnetic disk storage |
| Introduced: | 2003 |
| Active: | Yes [2010] |
| Cessation: | - |
| Capacity: | Up to 2TB [2010] |
| Compatibility: | Compatible with at least one version of all major operating systems: supports versions of Windows after XP. Also, drives with a capacity of 137GB or more are only compatible with Windows 98 onwards and Mac OS 10.2 onwards. Unlikely to be found on 8” or 5.25” drives. |
| Users: | Servers, desktop and laptop computers. Adopted by IBM and Apple to replace ATA. |
| File Systems: | FAT, NTFS, HFS/+, ext |
| Common manufacturers: | Present [2010]: Western Digital, Seagate, Toshiba, Past: Maxtor |
Recognition
SATA was introduced in 2003 as a faster version of ATA and is used with desktops, laptops and servers. It was intended to replace ATA, and had almost completely done so by 2007. SATA uses AHCI (Advanced Host Controller Interface) and if a computer does not have it SATA runs in ATA emulation mode. This applies to Windows OS up to Windows XP, though Windows Vista and later versions support AHCI. Linux with a kernel version 2.16.19 onwards will support AHCI as will Solaris operating system.
The SATA interface uses a 7-pin connector and socket, as seen in the above image. SATA differs from its predecessors in that it has the option of two power sockets. There is the standard Molex power socket on the right, but SATA drives also have their own power socket. This is a 15-pin connector situated next to the data socket. The image below shows the reverse side of the hard disk drive. The data socket is on the left and the power connector is on the right.
The images below show the two male connectors, with the data connector first then the power connector.
Initially SATA had a transfer rate of 131 MB/s and the SATA revision 2.0 increased this to 300 MB/s. SATA is still currently being developed and the latest version released in 2009 has a transfer rate of 600 MB/s. External SATA hard disk drives often include their own eSATA connector. More information about this will be in the next post.
Small Computer Scientific Interface (SCSI) Interface
| Type: | Magnetic storage media |
| Introduced: | 1981 (under the name SASI) |
| Active: | Only on existing computers |
| Cessation: | Early twenty-first century |
| Capacity: | 2 TB |
| Compatibility: | Compatible with all operating systems, though drives with a capacity of 137GB or more are only compatible with Windows 98 onwards and Mac OS 10.2 onwards. |
| Users: | Servers and primarily high-end computers. Used on all microcomputers until ATA established. Used by Apple for low-end machines until 1994 and high-end machines until 1999. |
| File Systems: | FAT, NTFS, HFS/+, CP/M, ext, MFS |
| Common manufacturers: | Present: Western Digital, Seagate, Toshiba, Past: IMB, Apple, Sony, Hewell-Packard, Maxtor |
Recognition
SCSI was introduced in 1981 under the name SASI (Shugart Associates System Interface). It was used with various operating systems including Microsoft Windows, Mac OS, Unix and Linux. However, as ATA gained popularity SCSI became associated more with high-end machines and servers. Even then SCSI began to lose popularity in the 1990s and was abandoned by Apple Macintosh in 1999. In the last decade provision for SCSI on motherboards has been largely discontinued with manufacturers preferring SATA and SAS.
The first SCSI interface had a transfer rate of 3.5 MB/s which soon increased to 5 MB/S. The rate increased in 1994, 1997 and again in 2003 to reach 320 MB/s.