WEBVTT 00:00.080 --> 00:01.430 Hard disk drives. 00:01.520 --> 00:07.220 Now that we've had a good look at non-volatile storage, including tape and flash storage, let's go 00:07.220 --> 00:09.980 a bit deeper into the world of hard disk drives. 00:10.010 --> 00:13.670 Heads which serve as fixed storage media. 00:14.030 --> 00:19.850 I'll try to keep things simple and short by focusing mainly on the knowledge necessary for forensics 00:19.850 --> 00:26.420 investigators in particular, HDD technology has certainly come a long way from the monstrous storage 00:26.420 --> 00:33.620 devices first seen in IBM mainframes and is now more compact, fast and affordable with capacities in 00:33.620 --> 00:34.610 the terabytes. 00:34.640 --> 00:40.340 Although the newer, solid state drives use the same type of memory found in flash memory devices, 00:40.370 --> 00:44.020 they are still a bit costly when compared to mechanical drives. 00:44.030 --> 00:50.240 This may be perhaps one of the contributing factors to why older mechanical drive technology is still 00:50.270 --> 00:51.170 being used. 00:51.200 --> 00:57.530 Mechanical drives consist of moving parts, including platters and actuator arm and a very powerful 00:57.530 --> 00:58.280 magnet. 00:58.490 --> 01:04.380 Although it is very common to still find these mechanical heads in today's laptops and hard drives, 01:04.380 --> 01:10.320 they are much slower than the newer, solid state drives which have no moving parts and look very similar 01:10.320 --> 01:13.110 to the chipset of a USB flash drive. 01:13.140 --> 01:19.800 In your forensics investigations and adventures, you may come across or be presented with older HDDs 01:19.800 --> 01:25.320 that can have different interfaces and use different cable technologies to connect to motherboards. 01:25.350 --> 01:27.360 Let's have a look, shall we? 01:27.660 --> 01:28.320 ID. 01:30.120 --> 01:37.410 Many of the first PCs in the mid 1980s were outfitted with hard drives that used parallel advanced technology 01:37.410 --> 01:41.340 attachment Pata and integrated drive electronics. 01:41.370 --> 01:41.940 I'd. 01:42.800 --> 01:46.430 Technology, as with all older devices back then. 01:46.460 --> 01:51.530 Parallel transmission was the order of the day, allowing for very limited throughput. 01:51.560 --> 01:58.130 An easy way to identify older drives is to simply have a look at the interface where the data and power 01:58.130 --> 02:00.110 cables connect to the drive. 02:00.410 --> 02:06.650 These older drives, as in the following photo, have four pins for power which connect to a molex connector 02:06.680 --> 02:13.310 separated by eight pins used to set the device as a master or slave device and then 40 pins for the 02:13.310 --> 02:17.270 ID data cable, which transmits the data to the motherboard. 02:17.300 --> 02:26.180 In 1994, advancements in technology led to the release of enhanced Integrated Drive Electronics IDE, 02:26.480 --> 02:33.020 which saw an increase in the number of pins for the data cable from 40 to 80, also increasing the transmission 02:33.020 --> 02:37.520 speeds from four maps to a possible 133 maps. 02:38.180 --> 02:47.220 ID ID was still, however, limited to a maximum of four ID slash IDE drives per computer as the jumper 02:47.220 --> 02:54.450 pins on the drive only allowed for two primary and two secondary drives set in a master slave configuration. 02:54.750 --> 03:03.660 Consideration also had to be given to the fact that R1 and R2 devices and Dvd-rom and R2 devices were 03:03.660 --> 03:07.860 also using IDE slash IDE technology at that time. 03:08.190 --> 03:10.110 Sata HDDs. 03:10.260 --> 03:16.620 In 2002, Seagate released an HDD technology called Serial Advanced Technology. 03:17.310 --> 03:24.810 Attachment Sata, which used serial transmission instead of slower parallel transmission, while Pata 03:24.810 --> 03:30.000 drives speeds of 3366 133 maps. 03:30.270 --> 03:36.100 Sata boasts speeds of 150/300 slash 600 maps. 03:36.120 --> 03:44.250 This meant that the lowest Sata transmission speed of 150 maps was faster than the highest pata speed 03:44.250 --> 03:46.650 of 133 maps. 03:46.800 --> 03:52.710 The connector interfaces of the Sata drives were also different, but it was common at the time to see 03:52.770 --> 03:59.970 Sata drives with connectors for both Sata and Pata power cables for backward compatibility. 04:00.300 --> 04:07.020 Sata data cables are much thinner than Pata cables as they only contain seven wires connecting to seven 04:07.020 --> 04:07.800 pins. 04:08.160 --> 04:11.070 Sata devices use one cable per drive. 04:11.100 --> 04:21.700 Unlike Pata Evices which connect to drives on one ide ide cable connected in a master slave configuration. 04:21.850 --> 04:28.570 The following photo shows an older ATI drive with Sata data and power connectors to the right and the 04:28.570 --> 04:32.740 legacy IDE Molex Power cable four pins to the left. 04:33.100 --> 04:39.820 Sata still continues to be the standard today for drive technology for both desktops and laptops, and 04:39.820 --> 04:42.520 has had several revisions as listed here. 04:42.640 --> 04:48.880 Speeds listed are in megabytes per second and not maps megabits per second. 04:49.840 --> 04:55.780 Sata 1 to 150 amps as ATA 2 to 300. 04:55.780 --> 04:59.650 Nanos Sata 3 to 600 Mbps. 04:59.800 --> 05:05.140 The following photo shows two Sata laptop, 2.5in drives. 05:05.260 --> 05:10.930 The one to the left is damaged and has been opened for us to see the circular platter at the middle 05:10.930 --> 05:17.350 with the actuator arm at the top slightly positioned over the platter at the end of the actuator arm 05:17.350 --> 05:23.110 is a read write head, which actually does the reading and the writing of data to the platter. 05:23.380 --> 05:28.720 The drive on the right hand side in the photo is actually a hybrid drive or a solid state. 05:29.360 --> 05:31.390 Hybrid drive SSD. 05:31.790 --> 05:37.820 This is actually a mechanical drive like the one to the left, but also has flash memory in it to allow 05:37.820 --> 05:40.730 for faster access to the data on the Platters.