DF CHAP 5

Definition: Binary notation is a base-2 numerical system used in computing, where only two digits, 0 and 1, are used to represent values.
Conversion from Base-10 to Binary:
- To convert from Base-10 (decimal) to Binary:
- Divide the decimal number by 2.
- Record the remainder.
- Continue dividing the quotient by 2 until the quotient is 0.
- Read the remainders backward to get the binary equivalent.
- Example: To convert 13 to binary:
- 13 ÷ 2 = 6 remainder 1
- 6 ÷ 2 = 3 remainder 0
- 3 ÷ 2 = 1 remainder 1
- 1 ÷ 2 = 0 remainder 1
- Binary representation = 1101.
Conversion from Binary to Base-10:
- Multiply each digit of the binary number by 2 raised to its position value (counted from right to left, starting at 0).
- Sum the results to obtain the decimal equivalent.
- Example: For binary 1101:
- (1 × 2^3) + (1 × 2^2) + (0 × 2^1) + (1 × 2^0) = 8 + 4 + 0 + 1 = 13.

Definition: Hexadecimal notation is a base-16 numerical system that uses sixteen symbols (0-9 and A-F) to represent values.
Conversion from Base-10 to Hexadecimal:
- Divide the decimal number by 16.
- Record the remainder as the hex digit (0-9 or A-F).
- Continue dividing until the quotient is 0, reading remainders backward.
- Example: Convert 255 to hex:
- 255 ÷ 16 = 15 remainder 15 (F)
- 15 ÷ 16 = 0 remainder 15 (F)
- Hex representation = FF.
Conversion from Hexadecimal to Base-10:
- Multiply each digit by 16 raised to its position value (counted from right to left, starting at 0) and sum:
- Example: For hex FF:
- (15 × 16^1) + (15 × 16^0) = 240 + 15 = 255.
Relation to Binary:
- Each hex digit corresponds to four binary digits (bits).
- Example:
- Hexadecimal A = Binary 1010.
- Therefore, two hex digits can represent eight binary digits.

CMOS (Complementary Metal-Oxide-Semiconductor):
- A type of memory used to store BIOS settings and system configuration.
- Retains information even when the computer is powered off by using a battery.
- Often contains system time and hardware configuration data.
BIOS (Basic Input/Output System):
- Firmware that initializes and tests hardware during the booting process.
- Loads the bootloader for the operating system from the disk.
Importance to Investigators:
- Investigators can recover system settings and identify hardware components based on information stored in CMOS and BIOS.
- It helps determine if the system has been tampered with and recover potential evidence related to the setup and configuration of the computer.

Platters: Circular disks coated with magnetic material where data is stored.
Spindle: The motor that spins the platters, typically at speeds of 5400 or 7200 RPM.
Read/Write Heads: Locate on actuators and move above the platters to read or write data.
Actuator Arm: Mechanism that moves the heads to the correct position over the platters.
Interface: Connects the drive to the computer, such as SATA or SCSI interfaces.
Cache Memory: A small amount of high-speed memory used to temporarily store frequently accessed data for quicker access.

Definition: File Allocation Table (FAT) is an older file system used by Windows and other operating systems.
Structure:
- Utilizes a table to keep track of which clusters on the disk are free, occupied, or bad.
Advantages:
- Simple structure allows for easy recovery of files.
Disadvantages:
- Limited security features and scalability issues.

Definition: New Technology File System (NTFS) is a more advanced file system used by modern Windows systems.
Features:
- Support for large volumes and file sizes (up to 16 exabytes).
- Efficient storage allocation and file compression capabilities.
- Security through file permissions and access control lists (ACLs).

Definition: Multi-stream capabilities that allow files to have multiple data streams associated with them.
Opportunities for Hiding Data:
- Data can be hidden in alternate data streams (ADS), which are not visible through standard file operations. This can be exploited to conceal malicious data or other sensitive information from investigators.

Definition: A feature that provides encryption for files and folders on NTFS volumes to secure data.
Accessing Encrypted Files:
- Requires appropriate user permissions and encryption keys to access.
- Files may be accessed by the user who encrypted them, or through recovery agents designated by the system administrator.

Definition: A centralized database that stores configuration settings and options for the operating system and installed applications.
Utility to Investigators:
- Can provide information about installed software, user preferences, system settings, and can reveal traces of user activity that could be crucial for an investigation.

POST (Power-On Self-Test): Hardware tests are conducted.
Bootloader Execution: The boot manager is loaded to choose which operating system to start.
Kernel Loading: The Windows kernel is loaded into memory.
Session Manager Initialization: Initiates essential system processes to get the graphical user interface ready.
User Logon: User authentication process occurs once the GUI is presented.

Solid-State Storage Devices (SSD):
- Use flash memory to store data, providing faster data access times and no moving parts, leading to durability and resistance to physical shock.
Magnetic Storage Devices (HDD):
- Use spinning disks and mechanical arms for data read/write operations, which can lead to slower performance and greater vulnerability to mechanical failure.

Write Blockers: Use to prevent data alteration during imaging or analysis.
Imaging Techniques: Use appropriate tools and methods designed for SSDs, such as specialized forensic software that accounts for TRIM and garbage collection processes.
Data Recovery: Be aware that traditional data recovery methods may not work effectively due to the nature of SSD storage techniques, and specific forensic strategies must be employed.
Securely Power Off: Always properly power down SSDs to avoid data loss and ensure integrity during evidence collection.