Digital Forensics Essentials - Module 03: Understanding Hard Disks and File Systems

Flashcards covering the fundamentals of hard disk drives, solid-state drives, logical disk structures, boot processes, and various file systems for Windows, Linux, and macOS.

Hard Disk Drive (HDD)

A non-volatile digital data storage device that records data magnetically on a metallic platter.

Tracks

Concentric circles on platters where all the information is stored; they are accessed by the drive head in one position at a time.

Cylinder

A group of all tracks that start at the same head position on the disk.

Sector

The smallest physical storage unit on the disk platter, typically holding $512$ bytes for HDDs and $2048$ bytes for CD-ROMs and DVD-ROMs.

4K Sector Technology

Also known as generation-one Advanced Format, it merges eight $512$-byte sectors into a single sector of $4096$ bytes.

Zoned Bit Recording

A method used to record data where tracks are combined into zones depending on their distance from the center, with each zone assigned a number of sectors per track.

Areal Density

The number of bits per square inch on a platter.

CHS (Cylinder-Head-Sector)

An addressing method that identifies physical blocks of data by specifying the radius, platter side, and angular position.

Seek Time

The amount of time required to send the first byte of a file to the CPU when it requests the file.

Solid-State Drive (SSD)

A non-volatile storage device that uses NAND flash memory chips and has no moving parts.

NAND Flash Memory

The main data storage unit in an SSD made up of floating gate transistors which retain charge state without power.

ATA/PATA (IDE/EIDE)

A standard interface between a motherboard's data bus and storage disks, as defined by ANSI.

Cluster

The smallest logical storage unit on a hard disk, consisting of a set of sectors.

Lost Clusters

Clusters marked as used by the OS but not allocated to any file; usually a result of logical structure errors rather than physical disk errors.

Slack Space

The storage area of a disk between the end of a file and the end of the cluster it occupies.

Master Boot Record (MBR)

The first sector (sector zero) of a data storage device that holds a partition table, bootstrapping code for the OS, and a $32$-bit disk signature.

BIOS Parameter Block (BPB)

A data structure in the partition boot sector that describes the physical layout of a storage volume.

Globally Unique Identifier (GUID)

A $128$-bit unique reference number used as an identifier in computer software, displayed as $32$ hexadecimal digits.

GUID Partition Table (GPT)

A partition system that replaces MBR, supporting up to $128$ partitions and using $64$-bit Logical Block Addresses (LBAs).

Cold Boot

The process of starting a computer from a powered-down or off state.

Ntoskrnl.exe

The executive and kernel file essential for the Windows system.

Hal.dll

The Hardware Abstraction Layer file used in Windows OS.

File Allocation Table (FAT)

A file system named for its method of organization (a table residing at the start of the volume) with versions including FAT12, FAT16, and FAT32.

New Technology File System (NTFS)

The standard file system of Windows NT and its descendants, featuring improvements like security access-control lists and journaling.

$mft

The Master File Table in NTFS which contains a record for every file.

Encrypting File System (EFS)

A technology first introduced in NTFS version $3.0$ that offers file system-level encryption transparent to the user.

Sparse Files

A method of saving disk space by allowing the I/O subsystem to allocate only meaningful (nonzero) data.

Filesystem Hierarchy Standard (FHS)

A standard that defines the directory structure and contents in Linux and Unix-like operating systems.

Journaling File System

A file system that records update information in a journal before applying it to ensure data integrity during crashes or power failures.

Apple File System (APFS)

A proprietary file system developed by Apple for macOS $10.13$ and later, consisting of a container layer and a file system layer.

Autopsy

A digital forensics platform and graphical interface to The Sleuth Kit (TSK) and other forensics tools.

WinHex

A hexadecimal editor used for computer forensics, data recovery, and low-level data processing.