Information Storage and Retrieval Technologies

Digital Forensics Process

• Recording information = encoding technologies.

• Retrieved information = decoding technologies

• A number of bytes are grouped into sectors

  • Usually 512 bytes

  • Referred to as block in a Linux system

• A number of sector are grouped as a cluster

  • Depends on file system

Magnetic Media - Hard Disk

Data is encoded as small magnets onto the magnetic surface of a hard disk.

Logical Block Address (LBA) is calculated by LBA = ( c x Nheads + h) x Nsectors + ( s – 1)

• c is cylinder, h is head and s is sector,

• Nheads is the number of heads in the drive.

• Nsector is the number of sectors per cylinder.

SMART Hard Disk

SMART - Self-Monitoring, Analysis and Reporting Technology

Modern drives uses error correction codes (ECG). These techniques store extra bits, determined by mathematical formulas, for each block of data; the extra bits allow many errors to be corrected invisibly.