Data Storage Types - Paiet/FOR---Operating-System-Forensics GitHub Wiki

A disk drive is a data storage device that uses different storage mechanisms such as mechanical, electronic, magnetic, and optical to store the data. It is addressable and rewritable to support changes and modification of data.

Disk drive types:

  1. Magnetic Storage - Floppy Drives, Tape Drives
  2. Optical Storage - CD | DVD | Blue Ray
  3. Flash Memory Storage - USB | BIOS | SD cards
  4. HDD
  5. SSD NAND based Volatile RAM based

Main physical components of a hard drive:

  1. Cylinders - the circular tracks present on the platters of the disk drive at equal distances from the center that are used to form a barrel like structure that groups the tracks together between the platters
  2. Head - a device present on the arm of the hard drive that reads or writes data on the magnetic platters
  3. Platter - disk like structures stacked together and used to store data
  4. Spindle - the spinning shaft on which holds the platters in a fixed position so that the read/write arms can read the data on the disks
  5. Actuator - a small motor that takes instructions from the drive's circuit board to control the movement of the read/write arm and supervise the transfer of data to and from the platters. It's responsible for ensuring the read/write heads are in exactly the right place at all times.
  • Track density - # of tracks in the hard disk
  • Areal density - # of bits / sq. inch on a platter
  • Bit density - bits / unit length of track
    • The data is recorded in the hard disk using zoned bit recording, which is the technique of grouping tracks into zones based on their distance from the center of the disk

Logical structure of a hard disk - mainly depends on the file systems used and the software that defines the process of accessing data from the disk. Operating systems use different types of file systems, and those file systems are used to control how data is stored and retrieved.

Common computer file systems are: FAT( 12 | 16 | 32 ) NTFS EXT ( 2 | 3 | 4 ) EFS HFS/HFS+

Hard Drive Interfaces

  1. SCSI (Small Computer System Interface) - It enables connection of up to 16 peripheral devices to one PCI board
  2. ATA - Advanced Technology Attachment Serial - half duplex channel @ 1.5 Gbps up to 6 Gbps Parallel - cable length up to 18 inches
  3. USB - Universal Serial Bus
  4. Fibre Channel - a point-to-point bi-directional high-speed network interface, which supports data transfer rates of up to 40 Gbps
  5. IDE/EIDE - Integrated Drive Electronics Master/Slave
  6. Serial Attached SCSI (SAS) - a point-to-point serial protocol that handles data flow among the computer storage devices such as hard drives and tape drives. (can support up to 65,535 devices)

Platters & Tracks:

Platters: 1. Platters are the round flat disks that hold data 2. Platters are made up of a substrate material & a magnetic coating 3. Data is written onto both sides of the platter

Tracks: 1. A track is a concentric circular ring on both sides of each platter 2. Drive head can access this circular ring in one position at a time 3. Tracks are numbered for identification purposes 4. Read-write is done by rolling heads from inner to outermost part of the disk

Track Numbering

1. Begins from 0 at outer edge and moves towards the center,
	typically reaching a value of 1023
2. Heads are moved in and out jointly so that both heads are always
	located together at the same track number
3. A cylinder is a group of all tracks that start at the same
	head position on the disk

Sectors

  1. The smallest physical storage unit on the disk platter
  2. Normally holds 512 bytes of data and a few additional bytes for drive control and error correction | Advanced Formatting uses 8512 byte sectors bound together into a 4K (4096 byte) sector
  3. Data is stored on the disk in a contiguous series, so if the file’s size is 850 bytes, two 512 sectors are allocated for the file
  4. Bad sectors refer to the areas of a hard disk that no longer support read or write activity due to a flaw

Clusters

1. The smallest allocation unit of a hard disk
2. A set of tracks & sectors from 2 - 32 grouped together
3. Typically 4K in size, but dependent on the size of the disk partition
4. Lost clusters are a File Allocation Table (FAT) error that results when the operating system marks clusters as used but does not allocate them to any file. They are a logical structure error and not a physical disk error. Lost clusters occur when the user does not close files properly or shuts down a computer without closing an application.

Programs that check the disk can be used to find and recover lost clusters (chkdsk)

Slack Space

  1. The free space on the cluster after writing data on that cluster
  2. If the size of the stored data is less than the cluster’s size, the unused area remains reserved for the file, resulting in slack space

Bit, Byte and Nibble

Bit - short for binary digit, is the smallest unit of data. It can
	contain only one of the two values represented as 0 or 1.
	They also represent logical values such as true/false, yes/no,
	activation states (on/off), algebraic signs (+/−)
	or any other two-valued attribute.

Byte - short for binary term consists of eight bits. The byte is a
	representation of the number of bits a system has used to encode one
	text character. It is the smallest addressable memory unit.
	Two hexadecimal digits represent a full byte or octet.

Nibble - known as a half-byte or tetrade, is a collection of four bits,
	or half of an octet. A byte is two nibbles.

Hard Disk Data Addressing

Cylinder-Head-Sector (CHS)

  1. Addresses data by simply specifying the cylinder (radius), head (platter side), and sector (angular position)
  2. Used on most IDE drives

Logical Block Address (LBA)

1. Addresses data by allotting a sequential number to each sector of
	the hard disk
2. Used on SCSI and enhanced IDE drives

Data density on a hard disk - Hard disks store data using the zoned bit recording method, which is also known as multiple-zone recording. Tracks form a collection of zones depending on their distance from the center of the disk and the outer tracks have more sectors on them than the inner tracks. This allows the drive to store more bits in each outer track compared to the innermost zone and helps to achieve a higher total data capacity.

Track Density - refers to the space a particular number of tracks require on a disk.

Areal Density - refers to the number of bits per square inch on a platter, and it represents the amount of data a hard disk can hold.

Bit Density - the number of bits a unit length of track can accommodate. How do I calculate disk capacity then?

A disk drive has 18,121 cylinders, 70 heads, and 43 sectors per track. Assume a sector has 512 bytes.

What is the capacity of such a disk? Answer:

Total bytes = 1 disk * (18,121 cylinders / disk) * (70 heads / cylinder) * (1 track / head) * (43 sectors / track) * (512 bytes / sector) = 27,926,635,520 bytes