1 00:00:00,080 --> 00:00:01,430 Hard disk drives. 2 00:00:01,520 --> 00:00:07,220 Now that we've had a good look at non-volatile storage, including tape and flash storage, let's go 3 00:00:07,220 --> 00:00:09,980 a bit deeper into the world of hard disk drives. 4 00:00:10,010 --> 00:00:13,670 Heads which serve as fixed storage media. 5 00:00:14,030 --> 00:00:19,850 I'll try to keep things simple and short by focusing mainly on the knowledge necessary for forensics 6 00:00:19,850 --> 00:00:26,420 investigators in particular, HDD technology has certainly come a long way from the monstrous storage 7 00:00:26,420 --> 00:00:33,620 devices first seen in IBM mainframes and is now more compact, fast and affordable with capacities in 8 00:00:33,620 --> 00:00:34,610 the terabytes. 9 00:00:34,640 --> 00:00:40,340 Although the newer, solid state drives use the same type of memory found in flash memory devices, 10 00:00:40,370 --> 00:00:44,020 they are still a bit costly when compared to mechanical drives. 11 00:00:44,030 --> 00:00:50,240 This may be perhaps one of the contributing factors to why older mechanical drive technology is still 12 00:00:50,270 --> 00:00:51,170 being used. 13 00:00:51,200 --> 00:00:57,530 Mechanical drives consist of moving parts, including platters and actuator arm and a very powerful 14 00:00:57,530 --> 00:00:58,280 magnet. 15 00:00:58,490 --> 00:01:04,380 Although it is very common to still find these mechanical heads in today's laptops and hard drives, 16 00:01:04,380 --> 00:01:10,320 they are much slower than the newer, solid state drives which have no moving parts and look very similar 17 00:01:10,320 --> 00:01:13,110 to the chipset of a USB flash drive. 18 00:01:13,140 --> 00:01:19,800 In your forensics investigations and adventures, you may come across or be presented with older HDDs 19 00:01:19,800 --> 00:01:25,320 that can have different interfaces and use different cable technologies to connect to motherboards. 20 00:01:25,350 --> 00:01:27,360 Let's have a look, shall we? 21 00:01:27,660 --> 00:01:28,320 ID. 22 00:01:30,120 --> 00:01:37,410 Many of the first PCs in the mid 1980s were outfitted with hard drives that used parallel advanced technology 23 00:01:37,410 --> 00:01:41,340 attachment Pata and integrated drive electronics. 24 00:01:41,370 --> 00:01:41,940 I'd. 25 00:01:42,800 --> 00:01:46,430 Technology, as with all older devices back then. 26 00:01:46,460 --> 00:01:51,530 Parallel transmission was the order of the day, allowing for very limited throughput. 27 00:01:51,560 --> 00:01:58,130 An easy way to identify older drives is to simply have a look at the interface where the data and power 28 00:01:58,130 --> 00:02:00,110 cables connect to the drive. 29 00:02:00,410 --> 00:02:06,650 These older drives, as in the following photo, have four pins for power which connect to a molex connector 30 00:02:06,680 --> 00:02:13,310 separated by eight pins used to set the device as a master or slave device and then 40 pins for the 31 00:02:13,310 --> 00:02:17,270 ID data cable, which transmits the data to the motherboard. 32 00:02:17,300 --> 00:02:26,180 In 1994, advancements in technology led to the release of enhanced Integrated Drive Electronics IDE, 33 00:02:26,480 --> 00:02:33,020 which saw an increase in the number of pins for the data cable from 40 to 80, also increasing the transmission 34 00:02:33,020 --> 00:02:37,520 speeds from four maps to a possible 133 maps. 35 00:02:38,180 --> 00:02:47,220 ID ID was still, however, limited to a maximum of four ID slash IDE drives per computer as the jumper 36 00:02:47,220 --> 00:02:54,450 pins on the drive only allowed for two primary and two secondary drives set in a master slave configuration. 37 00:02:54,750 --> 00:03:03,660 Consideration also had to be given to the fact that R1 and R2 devices and Dvd-rom and R2 devices were 38 00:03:03,660 --> 00:03:07,860 also using IDE slash IDE technology at that time. 39 00:03:08,190 --> 00:03:10,110 Sata HDDs. 40 00:03:10,260 --> 00:03:16,620 In 2002, Seagate released an HDD technology called Serial Advanced Technology. 41 00:03:17,310 --> 00:03:24,810 Attachment Sata, which used serial transmission instead of slower parallel transmission, while Pata 42 00:03:24,810 --> 00:03:30,000 drives speeds of 3366 133 maps. 43 00:03:30,270 --> 00:03:36,100 Sata boasts speeds of 150/300 slash 600 maps. 44 00:03:36,120 --> 00:03:44,250 This meant that the lowest Sata transmission speed of 150 maps was faster than the highest pata speed 45 00:03:44,250 --> 00:03:46,650 of 133 maps. 46 00:03:46,800 --> 00:03:52,710 The connector interfaces of the Sata drives were also different, but it was common at the time to see 47 00:03:52,770 --> 00:03:59,970 Sata drives with connectors for both Sata and Pata power cables for backward compatibility. 48 00:04:00,300 --> 00:04:07,020 Sata data cables are much thinner than Pata cables as they only contain seven wires connecting to seven 49 00:04:07,020 --> 00:04:07,800 pins. 50 00:04:08,160 --> 00:04:11,070 Sata devices use one cable per drive. 51 00:04:11,100 --> 00:04:21,700 Unlike Pata Evices which connect to drives on one ide ide cable connected in a master slave configuration. 52 00:04:21,850 --> 00:04:28,570 The following photo shows an older ATI drive with Sata data and power connectors to the right and the 53 00:04:28,570 --> 00:04:32,740 legacy IDE Molex Power cable four pins to the left. 54 00:04:33,100 --> 00:04:39,820 Sata still continues to be the standard today for drive technology for both desktops and laptops, and 55 00:04:39,820 --> 00:04:42,520 has had several revisions as listed here. 56 00:04:42,640 --> 00:04:48,880 Speeds listed are in megabytes per second and not maps megabits per second. 57 00:04:49,840 --> 00:04:55,780 Sata 1 to 150 amps as ATA 2 to 300. 58 00:04:55,780 --> 00:04:59,650 Nanos Sata 3 to 600 Mbps. 59 00:04:59,800 --> 00:05:05,140 The following photo shows two Sata laptop, 2.5in drives. 60 00:05:05,260 --> 00:05:10,930 The one to the left is damaged and has been opened for us to see the circular platter at the middle 61 00:05:10,930 --> 00:05:17,350 with the actuator arm at the top slightly positioned over the platter at the end of the actuator arm 62 00:05:17,350 --> 00:05:23,110 is a read write head, which actually does the reading and the writing of data to the platter. 63 00:05:23,380 --> 00:05:28,720 The drive on the right hand side in the photo is actually a hybrid drive or a solid state. 64 00:05:29,360 --> 00:05:31,390 Hybrid drive SSD. 65 00:05:31,790 --> 00:05:37,820 This is actually a mechanical drive like the one to the left, but also has flash memory in it to allow 66 00:05:37,820 --> 00:05:40,730 for faster access to the data on the Platters.