Unit 2: Hard Disks, File Systems and Data Acquisition

CSC303 — Digital Forensics 7 min read

I. Orientation: The Forensic View of Storage

Digital forensics treats every storage device as a layered stack of physical media, logical structures and file-system metadata, all of which must be preserved unaltered before analysis. The guiding rule (Locard's exchange principle applied to bits) is that examination must not modify the evidence: acquisition happens through write-blockers onto verified copies.

Layered model: Physical (platters/cells) → logical (sectors, partitions) → file system (metadata, files) → application data; the examiner works top-down but preserves bottom-up.
Sector: The smallest addressable unit, historically 512 bytes, now often 4096 bytes (Advanced Format / 4Kn).
Integrity: Every image is fingerprinted with a cryptographic hash (MD5, SHA-1, SHA-256); a matching hash proves the copy equals the original.
Chain of custody: Documented control of evidence from seizure to court, required for admissibility.
Order of volatility: Acquire volatile data (RAM) before non-volatile (disk) when both are in scope.

II. Disk Drives and Storage Structure

A. Describe different types of disk drives and their characteristics

Storage devices differ in mechanism, speed and forensic behaviour.

HDD (Hard Disk Drive): Rotating magnetic platters read by moving heads; spin rates 5400–15000 RPM. Deleted data often persists until overwritten, aiding recovery.
SSD (Solid State Drive): NAND flash cells, no moving parts, fast random access. TRIM and garbage collection can wipe deleted blocks autonomously, complicating recovery.
Interfaces: PATA/IDE, SATA, SCSI/SAS, NVMe (SSDs over PCIe), and external USB.
Optical/other: CD/DVD/Blu-ray, magnetic tape (archival), flash media (SD, USB sticks).
Key characteristics: Capacity (GB/TB), transfer rate, seek/access latency, and whether the medium performs self-modification (SSD wear-levelling).

B. Explain the logical structure of a disk

The logical structure maps physical geometry to addressable blocks and partitions.

CHS addressing: Cylinder-Head-Sector, the legacy scheme tied to physical geometry.
LBA (Logical Block Addressing): Sectors numbered linearly 0 … N-1, replacing CHS.
MBR (Master Boot Record): First 512-byte sector; holds 446-byte bootstrap code, a 4-entry partition table, and signature 0x55AA. Limits: 4 primaries, 2 TB maximum.
GPT (GUID Partition Table): Modern scheme using 64-bit LBA, supporting >2 TB and up to 128 partitions; keeps a protective MBR and backup header at disk end.
Partition → Volume → File system: Each partition is formatted with a file system; the boot sector of the active partition begins the load.

C. Understand storage systems

Larger deployments aggregate drives for capacity, speed or resilience.

RAID (Redundant Array of Independent Disks): RAID 0 stripes for speed (no redundancy); RAID 1 mirrors; RAID 5 stripes with distributed parity (survives one failure); RAID 10 mirrors striped sets.
DAS: Direct-Attached Storage bound to one host.
NAS: Network-Attached Storage, file-level access over TCP/IP (NFS, SMB).
SAN: Storage Area Network, block-level access via Fibre Channel/iSCSI.
Cloud storage: Off-premise object stores; forensic challenge is jurisdiction and lack of physical access. Forensically, RAID must be reassembled logically before imaging striped members.

III. Understand Booting Process of Windows, Linux and Mac Operating Systems

Booting is the firmware-to-kernel handoff; each stage leaves forensic artefacts (boot logs, timestamps).

A. Windows boot

Firmware: BIOS→MBR or UEFI→GPT (ESP).
Sequence: Firmware POST → boot manager bootmgr → winload.exe loads ntoskrnl.exe and HAL → smss.exe → session/logon.
UEFI path: Uses BCD (Boot Configuration Data) store in the EFI System Partition.

B. Linux boot

Sequence: Firmware → bootloader GRUB2 → kernel (vmlinuz) + initramfs mounts root → first process init/systemd (PID 1) starts services.

C. Mac boot

Sequence: UEFI-based firmware → boot.efi → XNU kernel → launchd (PID 1). Modern Macs use Apple Silicon/T2 secure boot with signed images and FileVault-encrypted volumes.

IV. Understand Various File Systems of Windows, Linux and Mac Operating Systems

A file system organises data into files and directories via metadata structures the examiner parses to recover names, timestamps and content.

A. Windows file systems

FAT (FAT16/FAT32): Simple File Allocation Table chains clusters; FAT32 caps files at 4 GB. Deleted entries flag the first filename byte 0xE5, so recovery is often trivial.
exFAT: FAT successor for flash media, removing the 4 GB limit.
NTFS: Uses the Master File Table (MFT), one record per file, with attributes for data (resident small files stored in the MFT), timestamps, and ACL security. Features: journaling ($LogFile), Alternate Data Streams (ADS), and metadata files ($MFT, $Bitmap).

B. Linux file systems

ext2/ext3/ext4: Inode-based; each inode stores metadata and block pointers. ext3 adds journaling; ext4 adds extents and larger volumes.
Others: XFS, Btrfs (copy-on-write, snapshots). Deletion clears block pointers, making recovery harder than FAT.

C. Mac file systems

HFS+ (Mac OS Extended): B-tree Catalog File indexing files and folders.
APFS (Apple File System): Default since macOS 10.13; copy-on-write, native snapshots, space-sharing containers, and strong encryption.

V. Forensic Examination and Data Representation

A. Examine file system using Autopsy and The Sleuth Kit tools

The Sleuth Kit (TSK) is a command-line library; Autopsy is its graphical front end, both parsing file-system metadata read-only.

mmls: Lists the partition/volume layout and sector offsets.
fsstat: Reports file-system details (type, block size, MFT/inode ranges).
fls: Lists files and directories, including deleted entries (* prefix).
icat: Extracts file content by inode/MFT number.
Autopsy features: Timeline analysis, keyword search, hash matching, carving, and case management with tagging and reporting.

Worked example — locating and extracting a file:

BASH

mmls disk.img              # find partition start, e.g. offset 2048
fsstat -o 2048 disk.img    # confirm NTFS, block size
fls -o 2048 disk.img       # list entries, note file's MFT number, e.g. 71
icat -o 2048 disk.img 71 > recovered.docx

B. Understand encoding standards and hex editors

Raw bytes carry no meaning until interpreted through an encoding; hex editors expose that raw layer.

ASCII: 7-bit, 128 characters; A = 0x41, 0 = 0x30.
Unicode/UTF-8: Variable-width superset covering all scripts; UTF-8 keeps ASCII bytes unchanged.
UTF-16: Fixed 2-byte units used internally by NTFS filenames.
Endianness: Little-endian stores least-significant byte first (x86); the value 0x1234 appears as bytes 34 12.
File signatures (magic numbers): Header bytes identify type regardless of extension — JPEG FF D8 FF, PNG 89 50 4E 47, PDF 25 50 44 46.
Hex editors (WinHex, HxD): Display offset, hex and ASCII columns; used to inspect headers, carve files and edit sectors manually.

VI. Data Acquisition

A. Understand data acquisition fundamentals

Acquisition is the forensically sound copying of evidence media, prioritising completeness and integrity.

Bit-stream image: An exact sector-by-sector copy, including slack and unallocated space — unlike a logical file copy.
Write-blocker: Hardware or software device permitting reads only, preventing evidence modification.
Hash verification: Source and image hashes must match; recorded before and after.
Image formats: raw/dd (bit-for-bit, no metadata), E01 (EnCase Expert Witness) with embedded metadata and compression, AFF open format.
Acquisition types: 1. Physical — the entire drive including partition gaps; 2. Logical — only a chosen volume or file set, faster but incomplete.

B. Understand data acquisition methodology

A repeatable procedure ensures results are defensible in court.

Assess and document: Record device make, model, serial, and scene condition; maintain chain of custody.
Choose method: Live acquisition for running/encrypted systems; dead (static) acquisition for powered-off media.
Connect through write-blocker and select target and format.
Acquire and verify: Compute source hash, image, then compare hashes.
Contingency: Take two images where feasible; if a drive is failing, image the good sectors first.

C. Prepare an image file for examination

Before analysis the image is verified and mounted read-only so tools can parse it.

Verify integrity: Re-hash the image and confirm it matches the acquisition record.
Convert if needed: Translate E01 to raw or mount E01 directly with ewfmount.

Mount read-only: Expose the image without altering it, e.g.: