Hard disk drives.
Now that we've had a good look at non-volatile storage, including tape and flash storage, let's go
a bit deeper into the world of hard disk drives.
Heads which serve as fixed storage media.
I'll try to keep things simple and short by focusing mainly on the knowledge necessary for forensics
investigators in particular, HDD technology has certainly come a long way from the monstrous storage
devices first seen in IBM mainframes and is now more compact, fast and affordable with capacities in
the terabytes.
Although the newer, solid state drives use the same type of memory found in flash memory devices,
they are still a bit costly when compared to mechanical drives.
This may be perhaps one of the contributing factors to why older mechanical drive technology is still
being used.
Mechanical drives consist of moving parts, including platters and actuator arm and a very powerful
magnet.
Although it is very common to still find these mechanical heads in today's laptops and hard drives,
they are much slower than the newer, solid state drives which have no moving parts and look very similar
to the chipset of a USB flash drive.
In your forensics investigations and adventures, you may come across or be presented with older HDDs
that can have different interfaces and use different cable technologies to connect to motherboards.
Let's have a look, shall we?
ID.
Many of the first PCs in the mid 1980s were outfitted with hard drives that used parallel advanced technology
attachment Pata and integrated drive electronics.
I'd.
Technology, as with all older devices back then.
Parallel transmission was the order of the day, allowing for very limited throughput.
An easy way to identify older drives is to simply have a look at the interface where the data and power
cables connect to the drive.
These older drives, as in the following photo, have four pins for power which connect to a molex connector
separated by eight pins used to set the device as a master or slave device and then 40 pins for the
ID data cable, which transmits the data to the motherboard.
In 1994, advancements in technology led to the release of enhanced Integrated Drive Electronics IDE,
which saw an increase in the number of pins for the data cable from 40 to 80, also increasing the transmission
speeds from four maps to a possible 133 maps.
ID ID was still, however, limited to a maximum of four ID slash IDE drives per computer as the jumper
pins on the drive only allowed for two primary and two secondary drives set in a master slave configuration.
Consideration also had to be given to the fact that R1 and R2 devices and Dvd-rom and R2 devices were
also using IDE slash IDE technology at that time.
Sata HDDs.
In 2002, Seagate released an HDD technology called Serial Advanced Technology.
Attachment Sata, which used serial transmission instead of slower parallel transmission, while Pata
drives speeds of 3366 133 maps.
Sata boasts speeds of 150/300 slash 600 maps.
This meant that the lowest Sata transmission speed of 150 maps was faster than the highest pata speed
of 133 maps.
The connector interfaces of the Sata drives were also different, but it was common at the time to see
Sata drives with connectors for both Sata and Pata power cables for backward compatibility.
Sata data cables are much thinner than Pata cables as they only contain seven wires connecting to seven
pins.
Sata devices use one cable per drive.
Unlike Pata Evices which connect to drives on one ide ide cable connected in a master slave configuration.
The following photo shows an older ATI drive with Sata data and power connectors to the right and the
legacy IDE Molex Power cable four pins to the left.
Sata still continues to be the standard today for drive technology for both desktops and laptops, and
has had several revisions as listed here.
Speeds listed are in megabytes per second and not maps megabits per second.
Sata 1 to 150 amps as ATA 2 to 300.
Nanos Sata 3 to 600 Mbps.
The following photo shows two Sata laptop, 2.5in drives.
The one to the left is damaged and has been opened for us to see the circular platter at the middle
with the actuator arm at the top slightly positioned over the platter at the end of the actuator arm
is a read write head, which actually does the reading and the writing of data to the platter.
The drive on the right hand side in the photo is actually a hybrid drive or a solid state.
Hybrid drive SSD.
This is actually a mechanical drive like the one to the left, but also has flash memory in it to allow
for faster access to the data on the Platters.