Lecture 5 Digital Forensics - Disks, Partitions & Volumes

Hard Disk Drive (HDD)

• Metal platter with magnetic coating.

• Read & write operations via arm heads detecting/altering magnetic polarity.

• Minimum storage unit: sector (typically 512 bytes, or 4096 bytes in Advanced Format).

• Cluster: fixed set of sectors.

• LBA (Logical Block Addressing) numbers each sector.

  • 32bit OS with 512 bytes sectors can address 2TB disks

  • 32bit OS using Advanced Format can address 16TB disks

Solid State Drive (SSD)

• Data stored in NAND flash memory.

• Wear levelling moves data to balance wear.

• TRIM command cleans flash cells during garbage collection.

• Implications for Digital Forensics:

  • Data recovery varies; reduced with TRIM.

  • Wear levelling moves data, but hashes maintain integrity after bit-by-bit copy with a write-blocker.

Disk Usage Preparation

1. Initialisation: Disk signature written to identify the disk.

2. Partitioning: Dividing the physical disk into data storage spaces.

3. Formatting: Preparing a partition to store data

   
   Disk usage preparation refers to the steps taken to ready a digital storage device for forensic analysis, ensuring data integrity, evidence preservation, and proper examination procedures.

   📋 Key Steps in Disk Usage Preparation

   1. 🔒 Write Protection

   • Use a write blocker (hardware or software) to ensure no data is altered on the suspect disk.

   • Prevents accidental or intentional modification during analysis.

   2. 🧪 Disk Imaging

   • Create a bit-by-bit (forensic) image of the original disk using tools like:

     • dd/ /FTK Imager / Guymager

   • Work only on the image copy, not the original.

   3. 🧾 Hashing

   • Generate cryptographic hash values (e.g., MD5, SHA-1/SHA-256) of the original and image files.

   • Verifies the image’s integrity and authenticity.

   4. 📊 Initial Analysis & Documentation

   • Record disk information: serial number, make/model, capacity, partition layout.

   • Identify file systems, partitioning schemes (MBR/GPT), and volumes.

   • Look for signs of encryption or anti-forensic measures.

   5. 🧼 Environment Preparation

   • Ensure your forensic workstation is clean and isolated.

   • Use trusted forensic tools in a controlled lab environment.

   🕵‍♂️ Why It Matters in Forensics

   • Maintains chain of custody

   • Preserves data integrity

   • Ensures analysis is legally defensible————————————————————————————————-

Partitioning Schemes – Quick Overview

In digital forensics and operating systems, partitioning schemes define how a physical storage device (like a hard drive) is divided into logical sections (partitions) that can hold file systems or operating systems.

📂 Common Partitioning Schemes

🕵‍♂️ Relevance in Forensics

• Helps identify how a drive is organized.

• Partition tables can reveal hidden partitions or wiped areas.

• Corrupted or manipulated partitions may indicate attempts to conceal data.

• MBR/GPT structures are often analyzed early in an investigation.—————————————————————————-

Formatting

• Formatted partitions are called volumes.

• VBR (Volume Boot Record) is written at the first sector.

• File system structure is created.

• Windows allocates drive letters.———————————————————————————

Volume Boot Record (VBR) – Quick Summary

The Volume Boot Record (VBR) is the first sector of a partition on a storage device that contains information required to boot an operating system from that partition.

🧠 Key Features of the VBR

• Also called the Partition Boot Sector.

• Located at the beginning of each partition, not the entire disk (that’s the MBR).

• Contains:

  • Boot code (for loading the OS or file system)

  • Volume information (e.g., file system type – FAT, NTFS)

  • BIOS Parameter Block (BPB) – details like bytes per sector, sectors per cluster, etc.

📂 Difference from MBR (Master Boot Record)

🕵‍♂️ Relevance in Digital Forensics

• Can reveal the file system type and partition structure.

• A corrupted or missing VBR can prevent booting and may indicate data tampering or malware.

• Forensic tools can analyze the VBR to recover deleted or hidden partitions.———————————————————————————

Partition Hiding and Deletion

• Hiding involves changing the partition type code.

• Deletion removes the entry from the partition table.

• Partition Hiding and Deletion – Forensics Overview

  In digital forensics, partition hiding and partition deletion are common anti-forensic techniques used to conceal data or hinder investigations.

  🔒 Partition Hiding

  🧠 What It Is:

  Modifying the partition table (e.g., MBR or GPT) to make a partition invisible to the operating system.

  ⚙ How It’s Done:

  • Changing the partition type ID to an unrecognized value.

  • Modifying partition start and end addresses in the partition table.

  • Using disk editors or specialized tools to hide partitions.

  🔍 Forensic Significance:

  • The data still exists on the disk — just not visible to standard OS tools.

  • Can be uncovered using forensic tools that analyze raw disk sectors.

  • Indicates intentional obfuscation — a red flag in investigations.

  🗑 Partition Deletion

  🧠 What It Is:

  Removing a partition entry from the partition table, making the OS treat that space as "unallocated."

  ⚙ What Happens:

  • The file system metadata is often untouched unless overwritten.

  • The actual data in the deleted partition may still be intact.

  • Can be reversed or investigated with tools like TestDisk or Autopsy.

  🔍 Forensic Significance:

  • Deleted partitions can often be recovered, especially if no new data has overwritten the space.

  • Timestamps, file structures, and deleted content can be analyzed for evidence

  🧾 Summary Table

  Technique	Purpose	Data Still Present?	Detection Method
  Partition Hiding	Conceal data from OS	✅ Yes	Raw disk analysis, partition scanners
  Partition Deletion	Erase without wiping	✅ Often	Partition recovery tools

Disk Structure Terminology

• Physical Disk:
  The actual tangible hardware (e.g., HDD, SSD) that stores data.

• Partition:
  A logical division of the physical disk, defined in the partition table; used to organize space (e.g., for multiple OSes).

• Volume:
  A formatted partition with a file system (e.g., NTFS, FAT32) that can be mounted and used to store files.

🧠 Simple Analogy:

Volume Analysis

• First step in disk investigation.

• Reports disk layout and identifies hidden partitions or gaps.

• Analysis of VBRs to recover volumes from deleted partitions.Volume analysis is the process of examining a formatted partition (volume) on a storage device to extract and interpret file system data, files, and metadata for forensic purposes.

  🧠 What Is a Volume?

  A volume is a partition that has been formatted with a file system (e.g., NTFS, FAT32, ext4), making it usable by an operating system to store and organize files.

  🔍 Purpose of Volume Analysis

  • Recover deleted files or directories

  • Extract timestamps and metadata

  • Detect tampering or hidden data

  • Understand user activity and access patterns

  📂 Key Elements Analyzed

  Element	Description
  File system type	Determines how data is organized (e.g., NTFS, FAT32)
  Metadata structures	Info about files (e.g., size, timestamps, ownership)
  Directory entries	Logical folder structure and file locations
  Slack space	Unused space in file clusters — may contain remnants of deleted data
  Unallocated space	Regions not assigned to files — useful for file carving
  Alternate Data Streams (ADS)	Hidden streams in NTFS volumes
  Volume shadow copies	Snapshots used for backup and recovery; useful in investigations

  🧰 Tools Used in Volume Analysis: Autopsy / Sleuth Kit/ FTK Imager

  🕵‍♂️ Forensics Relevance

  • Vital for recovering deleted or hidden evidence.

  • Helps create a timeline of activity.

  • Can expose malicious file manipulation or unauthorized access—————————————————————.

BIOS and CMOS

• BIOS: Firmware controlling the computer from power on to OS control.

• CMOS: Battery-powered memory storing configuration settings.

• CMOS stores system time, hardware settings, and boot order.

• 
  

• In digital forensics, understanding BIOS and CMOS is important because they store crucial system settings and timestamps that can be used as evidence or indicators of tampering.

  🧠 BIOS (Basic Input/Output System)

  • A small program stored on a chip on the motherboard.

  • It initializes hardware during boot-up and loads the operating system.

  • Can provide boot order info and be analyzed for signs of unauthorized changes.

  ⚙ CMOS (Complementary Metal-Oxide-Semiconductor)

  • A small amount of battery-powered memory that stores BIOS settings, including:

    • System time/date

    • Hardware configuration

    • Boot sequence

  • Important in forensics for validating timestamps and checking for tampering (e.g. if a suspect changed the system clock).

  🔍 Forensics Relevance

  • Incorrect or altered CMOS time can affect file timestamps (e.g., last modified).

  • BIOS password protection can hinder access to a system but also indicate intent to conceal data.

  • 
    

  • Partition
    • Division of a physical disk – only resides on a single disk • Partitions define the layout of a disk
    • A set of contiguous sectors of a disk

    – Volume

    • Partition formatted with a file system (e.g., NTFS),

      managed by an Operating System (e.g., Windows 11)

    • It can span across more than one partition

    • It can span across several disks