Understanding Hard Drive And SSD Components And Data Storage

Components of a Hard Drive

Discuss about the Forensic Analysis of Frozen Hard Drive Using Static.

In the hard drive, there is not any iron nails, rather it has “shiny, circular "plate" of magnetic material called a platter, divided into billions of tiny areas.” These areas have the capability to be magnetized and demagnetized independently, in other words it can store one and zero (Tomer et al., 2017). Magnetism is being used for the storage of data in manner to allow hard drive to store data even if, there is not any power in it. 

There are four major components of the hard drive those can be presented as:

Platters: It has been the circular discs, where 0s and 1s are stored for the files being stored.

The Spindle: It keeps the platter in its location in manner to allow platters to rotate in its position (Shu et al., 2017).

Read or write Arm: it controls the read or write heads that is the actual one responsible for reading or writing data.

Actuator: It has been a small motor allowing motion and movement to the read/write arm after taking commands from the circuit board of the hard drive.

Other components: front-end circuit board, casing, ports, and other components hold the small components of the hard drive (Bos, 2017).

Yes, electron alignment can be done on the drive in manner to secure the hard drive. For the deletion of every data from the drive securely, it is necessary to change the magnetic value of the drive with 0s. It will helpful in blocking an individual to access the data or information previously saved in the drive (Schatz, 2017). It is the major concerning point that the drive should contain some 1s value in the drive as if, the whole data has been stored in 0s value, it becomes almost impossible to retrieve data from the drive. However, there are specialist equipment, those can be possible in retrieving data from the hard drive. It will become essential to write random pattern in the same location, followed by the zeroing pass. Dewald and Seufert (2017) stated that “there are other techniques to securely erase a CMOS / SSD but that involves overpowering the 'memory' cell to erase all values inside it.”

SSD (Solid-State Drive) stores data using semiconductor chips, despite of using magnetic media. The chips being stored in the SSD is responsible for delivering non-volatile memory in manner to manage the stability of the data even there is no power (Freiling Glanzmann & Reiser, 2017). It has never been established in the motherboard; rather it has been placed separately in the computer as a part of the computer. It allows the user to remove the drive from the computer without handling with secured elements of the computer (Robins, Williams & Sansurooah, 2017). It uses the same memory as that of the RAM called “Flash” and the difference is only that it keeps the data stored even if there is no power in the system.

Components of an SSD

Wear leveling can be greater concern with the SSD because of two reasons; firstly, there are the possibilities of getting different hash values every time during imaging the solid-state drive. The mathematical algorithms or the hash values could be represented through a string of letters and numbers those have been uniquely assigned to the set of the data, very similar to the digital fingerprint (Prem, Selwin & Mohan, 2017). These hash values can be utilized for verifying the “exact, bit for bit, copy of the original data prior to analysis, the original hash value of the data, and the copy, should be the same.” Second reason is that,; there are many obstacles in recovering the deleted files and could become impossible to recover it. The data those are necessary might be appearing at random location within the array of the memory regardless of the fact the location of the data should be (Abdi, 2017). The reasons behind this could be the over provisioning and wear leveling.

In the present time, researches are being made for the solution of these issues. The known “Department of Homeland Security’s Science and Technology Directorate, Cyber Security Division” for the funds and additional support in this context is delivering the research and investigations (Nemetz, Schmitt & Freilling, 2018). Theoretically, there are many solutions for the elimination of these problems however, in practical life none of the theoretical context meet the requirement of the identified issues.

It is possible to read and retrieve data through soldering the identical chip on other board and it can also be helpful in recovering the flash memories. In the present day, almost every chop has been packed in a micro BGA or a TSOP casing and it could be accomplished through de-soldering and using it in an efficient and effective manner despite of losing data. BP 1600 chip programmer can be utilized for reading the flash memory to recover the data of the flash memory (Lee et al., 2017). There will be the need of drivers for each type of memory chip and it can be listed n the disadvantages.

The easiest way can be the application of file recovery software that can be represented as a cost-effective and simple solution for recovering the deleted files. This will be helpful in recovering the files without any mess and will be much safer (Pyo, Lee & Lee, 2017).

For some of the cases, the file systems of the operating system that is a data file of more than a fixed size has been stored in the several fragments or chunks in place of the single contiguous bits sequence at a single storage space within the hard drive. This can be utilized for recovering data even if the file has been deleted from the drive through some if the unused sections of the storage where, the previous data or file had been stored (Boss et al., 2017).  Fragmentation over time can result in slow access to the data because of the condition that each file must be accessed for considering the whole file in manner to read in. the user can utilized for the data recovery through the process of defragmentation. Consolidation or defragmentation of the space available in the hard drive has been one of the better approach for the prevention techniques. Johnson et al. (2017) “when free space is in large contiguous blocks instead of scattered around the hard drive in smaller sections, new files that get written to the hard drive can be easily placed in one piece”. “When rewriting files during disk defragmentation, defraggers try to place all files closer together so that the remaining free space is consolidated into larger sections (Abeykoon & Feng, 2017).”

Securing and Deleting Data in a Hard Drive

Electronic components when exposed to water can be easily damaged and there are various type of issues that take place if the components are exposed to water. According to Jin (2017), energy is an essential element of the human social activities. Some important factors regarding the Lithium-ion batteries and the adverse effects of it when exposed to water has been provided here in this article. From the article can we can very easily understand that the batteries are critically damaged in case they come in contact with water and can catch fire easily. In addition to this, apart from the Lithium-ion batteries other electronic device might also face various critical conditions. Pure water is a very poor conductor of electricity, but when it contains ions (sodium and chloride), it can act as a good conductor of electricity. So, if this ion-filled water comes into contact with any electronic device in ON state, it is going to make connections in places, where there should be no connection resulting in large current which in turn damages the circuit (Sprecher, Kleijn & Kramer, 2014). Water can cause a short circuit in devices not designed to cope with a conductive liquid. Water contaminated with minerals, dirt, etc. will conduct. It won’t be a perfect conductor, but it will conduct. This can cause shorts, which in turn causes too high a current to go in places where it shouldn’t, and this is what can destroy electronics. Many electrical devices work fine in water, but they are designed to do so, for instance subversive electrical water pumps, undersea cables, kettles etc. Many electronic devices require very low currents, and shorting those makes they stop. Some older devices had higher currents, and could actually fry the components, but modern devices don't do this as much. In case the device is in the OFF state and water is spill on it the device will keep on working if dried up on time before turning it to on state as dried water can no longer make any undesired connections. However there are other factors that might rise up in this situation. One of the very important factor is corrosion. Water in the form of condensation can also be a problem, particularly with regard to corrosion, and some electrical devices that are otherwise unaffected by water mat crack when exposed to cool water, for instance a hot heat sink, due to rapid uneven cooling Corrosion happens on long term exposure with water. The connections between different devices is done using metal. When metal comes into contact with water, it starts corroding and converting to another non-conducting compound. Since the water contains a lot of ions, it speeds up the process of this corrosion (). In places with salty water (including coastal regions), things corrode very fast. Once the metal connection between two parts of the circuit is sufficiently corroded, the connection is broken and electronic device stops working. Conversely, There are several electrical devices that will be damaged if not exposed to water such as those used to boil water. And the conductive nature of water is used in some circuits, particularly in power transmission across oceans where there is only one conductive cable. Devices can be submerged in pure water and not an effect would take place to the device. Pure water is a very poor conductor, so it won’t affect the electronic devices very much if at all. Just to be clear: pure water is distilled water. However, in everyday life, pure water will become contaminated very quickly. The key to gross circuit damage is related to electrolysis. If the power to the unit is off when it is submerged then this effect is not present except for battery powered circuits which are intended to be always powered. For instance the idea of battery powered keep alive circuits is common on GPS receivers to store the Ephemeris data. Where these copper traces are exposed and powered they will electrolyze, copper will disappear depending on Voltage. Also, in the case of modern PC boards with microbial (conductive holes between layers) where the mediums were not tented in manufacturing, microbial may electrolyze depending on Voltage. Tenting is an option when designing PC artwork where the mediums have the protective solder mask printed over the medium. For people dealing with submerged electronics the recommendation is to dump the water from submersion and get it into clean (potable) water immediately. This may require opening the covers in order to dump out silt and other contaminants. A three step wash is better than a dump and refill. Equipment that has been allowed to dry with silt and other contaminants may have many additional problems besides electrolysis. Recovering electronics that have been submerged is an art. Experience with the same type of device from previous submersion is helpful. The devices can then be recovered to a certain extent.

Data Retrieval and Recovery for Hard Drives and SSDs

There are various methods of recovering a hard disk from water. If the hard drive is damaged by water, it’s important to take care of the issue as quickly as possible to have the best chance of recovering the data from the hard drive. Assumptions that leaving the hard drive alone for a few days won’t hurt the data in the hard drive should not be done. Hard drives are delicate, and can be easily damaged from mild bumps or drops. So trying to switch and power on the computer system, laptop, storage box, external USB HDD (Hard Disk Drive) or the Server etc. should not be done. Drying methods that involve heat can potentially damage the platters of the hard drive, making data recovery nearly impossible (Albanna & Riadi, 2017). All water, whether it’s water from a flood or storm, or water that people drink has particles and minerals in it that will stick to the platters of the hard drive if the hard drive dries out. That makes data recovery even more difficult than if the platters were already wet. Attempt to rinse or clean the hard drive if it is dirty, as doing so without the proper tools or solutions almost always makes recovering stored data from the hard drive more difficult. Attempt to remove the cover from the hard drive (Tabone & Sprangler, 2017). The idea of opening the device; this can expose it to airborne contaminates making hdd recovery impossible. Trust trained professionals can open the hard disk in controlled Class 100 Clean room environment, used specially in case of severely damaged hard disks. The water regardless of the source contains particles that can damage the platter making the situation critical. People attempt to keep the devices under sun or use blow dryer which further aggravates the chances of data recovery. The first area the drive tries to read on spin-up is the hard drive operating system (HDD O/S or drive firmware). The bulk of this operating system is unique in-factory calibrations and unique defect lists and unique zone tables that varies wildly from drive to drive and is required to make sense of the binary that gets pulled off the platters, or pulling data off the platters in the first place. So when people spin these up with dirt/moisture inside a lot of times this critical area gets wrecked and that can cause outright failure to recover data. The suggestion is to keep the media device (Hard Disk) wrapped in a towel or any air tight pack and opt for professional data recovery services. Doing so exposes the extremely sensitive platters of the hard drive to airborne particles, which makes recovering data from the hard drive nearly impossible. Wrapping the hard drive in paper towel and put it in an air tight bag while removing as much air from the bag as possible is a very good option for the recovery of the hard drive. No modern HDD platter is 100% "clean". Apart from error correction information that the OS includes in the data it stores, the firmware on the HDD controller board writes additional error correction information to counteract tiny areas of the platter that will always "fail". Because the controller board corrects these errors before handing information back to the OS, this low-level error correction is completely transparent. Data recovery specialists remove the cover of a hard drive only in an enclosed environment known as a Class 100 Clean room, which filters out all airborne particles that may be harmful to the platters of a hard drive. Additionally it should be noted that the hard drives can be dried using the provided options and used by the user after the drive is fully dried. However this, does not ensure that data in the drive will be fully recovered. In general the hard drive is destroyed in situations like this. If the drive is a SSD, data recovery may be difficult. Differ from files deletion on common hard drive, when deleting a file, the content will be erased immediately under the TRIM command.

Water Damage and its Effect on Electronic Devices

References

Abdi, A. N. E. (2017). MP4-Karver: carving of corrupted MP4 videos using ASMD repairing technique (Doctoral dissertation, Universiti Tun Hussein Onn Malaysia).

Abeykoon, I., & Feng, X. (2017, June). A Forensic Investigation of the Robot Operating System. In Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData), 2017 IEEE International Conference on(pp. 851-857). IEEE.

Albanna, F., & Riadi, I. (2017). Forensic Analysis of Frozen Hard Drive Using Static Forensics Method. International Journal of Computer Science and Information Security, 15(1), 173.

Bos, J. V. D. (2017, September). Sustainable automated data recovery: a research roadmap. In Proceedings of the 1st ACM SIGSOFT International Workshop on Software Engineering and Digital Forensics (pp. 6-9). ACM.

Boss, G. J., Drissi, Y., Rick, A. H. I., & Li, C. S. (2017). U.S. Patent No. 9,621,586. Washington, DC: U.S. Patent and Trademark Office.

Dewald, A., & Seufert, S. (2017). AFEIC: Advanced forensic Ext4 inode carving. Digital Investigation, 20, S83-S91.

Freiling, F., Glanzmann, T., & Reiser, H. P. (2017). Characterizing loss of digital evidence due to abstraction layers. Digital Investigation, 20, S107-S115.

Jin, C. (2017, December). Brief Talk about Lithium-ion Batteries’ Safety and Influencing Factors. In IOP Conference Series: Materials Science and Engineering (Vol. 274, No. 1, p. 012152). IOP Publishing.

Johnson, W., Ahmed, I., Roussev, V., & Lee, C. B. (2017, August). Peer Instruction for Digital Forensics. In 2017 {USENIX} Workshop on Advances in Security Education ({ASE} 17). USENIX} Association}.

Lee, C. E., Zheng, L., Zhang, Y., & Thing, V. L. (2017, February). Low-Dimensional Bigram Analysis for Mobile Data Fragment Classification. In SG-CRC (pp. 129-142).

Nemetz, S., Schmitt, S., & Freiling, F. (2018). A standardized corpus for SQLite database forensics. Digital Investigation, 24, S121-S130.

Prem, T., Selwin, V. P., & Mohan, A. K. (2017, April). Disk memory forensics: Analysis of memory forensics frameworks flow. In Power and Advanced Computing Technologies (i-PACT), 2017 Innovations in (pp. 1-7). IEEE.

Pyo, Y., Lee, C., & Lee, H. (2017, August). Visual analysis of corrupted video data in video event data recorders. In Dependable and Secure Computing, 2017 IEEE Conference on (pp. 453-458). IEEE.

Robins, N., Williams, P. A., & Sansurooah, K. (2017). An investigation into remnant data on USB storage devices sold in Australia creating alarming concerns. International Journal of Computers and Applications, 39(2), 79-90.

Schatz, B. (2017). U.S. Patent Application No. 15/328,452.

Shu, J., Zhang, Y., Li, J., Li, B., & Gu, D. (2017). Why data deletion fails? A study on deletion flaws and data remanence in Android systems. ACM Transactions on Embedded Computing Systems (TECS), 16(2), 61.

Sprecher, B., Kleijn, R., & Kramer, G. J. (2014). Recycling potential of neodymium: the case of computer hard disk drives. Environmental science & technology, 48(16), 9506-9513.

Tabone, R., & Spangler, R. R. (2017). U.S. Patent No. 9,836,606. Washington, DC: U.S. Patent and Trademark Office.

Tomer, S., Apurva, A., Ranakoti, P., Yadav, S., & Roy, N. R. (2017, October). Data recovery in Forensics. In Computing and Communication Technologies for Smart Nation (IC3TSN), 2017 International Conference on (pp. 188-192). IEEE.

Yang, Y., Xu, Z., Liu, L., & Sun, G. (2017). A security carving approach for AVI video based on frame size and index. Multimedia Tools and Applications, 76(3), 3293-3312.