Chapter 3. Handling Computer Hardware

Being cognizant of the diversity of computer hardware is also necessary because you need to know how systems can be connected to external devices, like routers or external hard drives. These connected devices, like routers, will often contain digital evidence and may need to be seized if a warrant permits. The investigator might also need to be able to reconstruct the computer and its devices when she returns to the laboratory.

Computer hardware, operating system(s), and applications also determine the kind of computer forensics tools necessary to acquire evidence from that system. For example, Mac Marshall Forensic software can be used to image (a strategy you learn about later in this chapter) a MacBook Pro running Mac OS X while Guidance Software’s EnCase can be used to image a computer running Windows. Knowing that a computer is running Windows may not always be enough, however, because the version of the operating system should influence an investigator’s decision regarding the type of forensic software to use. Additionally, the type of investigation determines the value of different types of evidence and guides the investigator to choose the most appropriate forensic tool. For example, in a case against an alleged sex offender, a computer forensics investigator might choose to use X-Ways Forensics, which has a particularly effective filtering feature for searching images for skin tones. Realistically, though, many local police departments simply do not have the budgets to purchase the full array of forensic tools and thus do not have the luxury of selecting the most appropriate tool. Moreover, even if they could purchase some of these tools, they do not have the training budget to support their usage.

Proper planning for an investigation is critical. This entails knowing different computer hardware, like hard drives and other devices, to purchase the appropriate equipment. As you will learn from this chapter, many of the connections and related forensic hardware cannot be purchased at a local Staples stationary store if you need something; much of the forensic hardware is specialized and is only available from a very limited number of suppliers.

Finally, the handling of computer hardware in an investigation has legal ramifications. Evidence must be seized and handled in accordance with standard operating procedures that follow the law in that jurisdiction. Ultimately, the process by which you acquired the evidence is just as important as the evidence itself.

This interface was developed by Western Digital, and these IDE drives were first installed in Compaq computers in 1986. This initial version of IDE can be referred to as ATA/ATAPI (Advanced Technology Attachment with Packet Interface). IDE and EIDE have been retrospectively called Parallel ATA or PATA.

Western Digital later introduced Enhanced IDE (EIDE) in 1994. IDE and EIDE connectors typically have 40 pins, although there are 80-pin versions, and the cable is generally 3.5 inches wide (see Figure 3.3).

The SATA power cable is a wider, 15-pin connector, distinguished by red and black wires (see Figure 3.5).

In some investigations, an investigator may come into contact with eSATA connections. Therefore, eSATA connectors should also be a part of the computer forensic investigator’s toolbox. eSATA is a variation of SATA that is used for external drives. See Figure 3.6.

SATA disk drives come in different sizes. A 1.8-inch hard drive (see Figure 3.7) is connected to the motherboard by a ZIF connector. These significantly smaller hard drives are found in Dell D420 and Dell 430 laptops. Toshiba manufactures these hard drives for Dell. The significance for an investigator is that the ZIF cable (see Figure 3.8) and adapter are very specialized and can be difficult to source.

A disk clone is an exact copy of a hard drive and can be used as a backup for a hard drive because it is bootable just like the original.

A disk image is a file or a group of files that contain bit-for-bit copies of a hard drive but cannot be used for booting a computer or other operations.

The image files can also be different because they can be compressed, unlike a disk clone, which is not compressed. When cloning, the bit-for-bit copy is transferred to a second hard drive that is of equal size or larger than the source drive. Another difference is that specialized software, like EnCase, X-Ways, or FTK, is needed to view the contents of the image files. In general, image-viewing software is read-only, and files cannot be added. Nevertheless, some applications allow image files to be edited; WinHex, which is produced by X-Ways Forensics, is one such example.

One forensic cloning device used in investigation is the Disk Jockey PRO Forensic Edition (see Figure 3.9). The device is write-protected and allows the user to copy directly from a SATA or IDE hard disk drive to another SATA or IDE hard disk drive.

Before the investigation, all harvest disk drives must be sanitized. The Disk Jockey PRO has a function that performs a Department of Defense (DoD) seven-pass secure erase. When a new hard drive is removed from the packaging, it should be securely erased because an attorney might question a forensic investigator on this. Other devices, like the WipeMASSter Hard Disk Sanitizer from Intelligent Computer Solutions, are used solely to securely erase hard disk drives.

Before embarking on an investigation, it is also helpful to identify the specifications of the suspect’s machine (the make and model), where possible. This enables the investigator to research the computer that they will be working on and learn how to remove the hard drive. This might sound like common sense, but removing a hard drive from a Dell Inspiron 6400 laptop for cloning is very different from removing the drive from a Dell Latitude D430. The equipment required to clone each of these hard drives is also very different. A Dell Inspiron 6400 is relatively easy to remove, and then you can connect a SATA data cable and a SATA power cable. For a Dell Latitude D430 (or D420) laptop, the battery must be removed; then a thin cable must be removed from the hard drive and a rubber casing around the drive also must be removed. A special ZIF cable, ZIF adapter, and IDE interface cable are necessary to connect the 1.8-inch SATA hard drive to the Disk Jockey PRO, as in Figure 3.10. If possible, also try to predetermine the target computer’s operating system.

A simple Internet search for “removing the hard drive dell 430” will result in helpful documentation (including pictures) that Dell has made available online. In fact, Dell maintains a web page for most of its computer models that details hard disk drive removal. For other computers, manufacturers provide similar documentation. Removing the hard drive from the most recent iMac is a very involved process that requires some unique tools. Apple provides comprehensive instructions on the removal of hard drives from iMacs. YouTube.com also has numerous helpful videos to help the investigator.

The Disk Jockey has both a “Disk Copy” and a “Disk Copy (HPA)” cloning function. An investigator should first attempt to use the Disk Copy (HPA) clone function. This function makes a copy of the disk that includes the Host Protected Area (HPA). The Host Protected Area (HPA) is a region on a hard disk that often contains code associated with the BIOS for booting and recovery purposes. Manufacturers use the HPA to assist in the recovery process and replace the need for a recovery CD. An investigator should try to make a copy of this area because criminals have been known to hide incriminating evidence in this region of the disk. Sometimes the Disk Jockey PRO is unable to recognize and copy the HPA. When an error message appears on the Disk Jockey PRO’s LCD display, the investigator must then use the Disk Copy function instead of Disk Copy (HPA).

In a single-level cell (SLC) NAND flash, each cell in the SSD has 1 bit. In a multilevel cell NAND flash, each cell has two or more bits. An MLC has higher density but generally requires more voltage than an SLC.

There are more than 60 SSD manufacturers, while there are very few hard disk drive manufacturers. There are numerous controller manufacturers who have different manufacturing requirements for SSD manufacturers. Therefore, this complicates the life of a computer forensics investigator, i.e. an SSD from one manufacturer can have different controllers with varying firmware. The proprietary firmware associated with the controller affects garbage collections, caching, wear-leveling, encryption, compression, bad block detection, and more.

Consider some examples of SSD controller manufacturers:

Marvell

Hyperstone

SandForce

Indilix

Phison

STEC

Fusion-io

Intel

Samsung

In many ways solid state drives are a more efficient alternative to hard disk drives, given their more efficient use of power; faster retrieval and storage of files; and greater resistance to environmental factors, including heat and vibration. Nevertheless, solid state drives suffer from ware-leveling. Ware-leveling is the process by which over time areas of a storage medium become unusable.

From a file storage perspective, solid state drives are very different from hard disk drives, and they do not use the traditional 512-byte storage sectors.

In terms of computer forensics, recovering deleted files on a solid state drive is more challenging as a result of the garbage collection process. Garbage collection is a memory-management process that removes unused files to make more memory available. Garbage collection is rather unpredictable with solid state drives and is particularly uncontrollable. Changes to files stored on a solid state drive can occur without warning, regardless of the best efforts of a computer forensics examiner. Garbage collection and other automated functions associated with an SSD mean that once a hash is forensically created for a hard drive, then when a hash is generated again on the same drive, the two hashes are unlikely to match, which is different with a HDD.

Unlike a hard disk drive, with an SSD, data must be erased before a write can occur; writes are completed in large blocks with high latency. Another difference is that the operating system does not keep track of the physical location of files; a file translation layer (FTL) is responsible for this. The File Translation Layer (FTL) maps a logical block address to a physical block address. TRIM is an operating system function that informs a solid state drive which blocks are no longer in use, which allows for high write performance. TRIM runs immediately after the Recycle Bin is emptied.

From a computer forensics perspective, it is important to know that a computer may have multiple hard drives connected to it, all of which have evidentiary value. It is also important for an investigator to note the order in which each drive was added to the RAID and which drive adapter is connected to which drive (it can be confusing).

These file registry entries are important in showing a history of what devices were connected to a computer. Every USB device has a serial number that is recorded in the subkey for that USB registry.

Access to files on a USB is not a forgone conclusion, however, because many of these storage devices have utilities built in. For example, Ironkey USB devices use AES 256-bit encryption to protect files on the device. These devices protect the user and enterprise from theft of intellectual property; after a series of unsuccessful attempts to access the device, the device automatically reformats the drive.

The file system found on a USB flash memory device is usually FAT, a file system that most computers recognize, although the device can be formatted to support other file systems.

In some cases, a cloning device may not be workable, so an investigator should always bring a write-blocker (including a USB write-blocker). For imaging and validating the drive, an investigator can bring FTK Imager Lite on a USB or perhaps carry Raptor 2.0 on a USB or bootable CD. Imaging a 250GB drive, with verification, using FTK Imager Lite could take just over two hours whereas cloning that same drive could take approximately 40 minutes. When cloning or imaging a hard drive, it is proper protocol to place the source and destination hard drives on an antistatic, rubberized mat to avoid any electromagnetic interference. Hard drives should also be transported in antistatic bags.

External hard drives are mostly used today for backups or as an extension to a computer’s memory. An examiner should be aware that an external hard disk drive could contain any number of file systems, including (Windows) NTFS or (Mac) HFS+. More important, if the external drive is connected to a PC with Windows 7 installed and BitLocker To Go is running, then disconnecting the drive from the computer may encrypt that external drive. In other words, think before you remove any USB device that is connected to a live system. Of course, external drives can also be eSATA or FireWire. Newer drives may also have software installed for backing up the drive, perhaps to a cloud service. It is important to check for all installed software utilities on the suspect’s drive and note that backup software and other data integrity utilities can be present on a separate partition.

The standard size for an SD card is 24mm wide and 32mm long, with a thickness of 2.1mm (see Figure 3.20). It is possible to find SD cards, which have a capacity of up to 4GB. The standard size is often used in digital cameras, and many laptops come with an SD card slot and reader as standard. More recently, SDHC (Secure Digital High Capacity) cards began to appear in the market, beginning with a capacity of 4GB. SDHC cards can go up to 32GB. Even more recently, 64GB cards began to appear with the emergence of SDXC (Secure Digital eXtended Capacity). Secure Digital cards are formatted with the FAT32 file system.

Note that some SD cards are WiFi enabled with preinstalled utilities. Some of these utilities can automatically send photos to a mobile device, upload files to social media sites, or even add files to a cloud service. Generally, a logo on the SD card indicates that the card is WiFi enabled, but this might not always be the case; the investigator should be cognizant of these wireless capabilities.

If you encounter an SD card during an investigation, it is proper protocol to set the write-protect switch to on, when present on the card, to prevent any data from being written to this memory. Of course, the investigator will use a write-blocker before examining any removable memory, like an SD card.

A miniSD is 20 mm wide and 21.5 mm long. The microSD format was developed by SanDisk. A microSD card can be used in a Standard Digital card reader with the use of an SD adapter. microSD cards are often found in cellular telephones, and therefore they can be a valuable source of evidence. Additionally, many cellphone forensic imaging or cloning devices cannot read the contents of the microSD card, so the card may have to be removed and imaged separately.

More recently, the Memory Stick XC (Extended High Capacity) series was released by Sony and SanDisk. These memory cards have the potential to store up to 2TB of memory. The XC series uses the exFAT (FAT64) file system. This series have maximum data transfer rates up to 160 Mbps and 480Mbps depending upon the XC model.

The important point for investigators to note is that if a suspect owns Sony products, Memory Sticks could be present in these devices. For example, a Sony television might have a Memory Stick inserted. Moreover, that memory card will probably contain files uploaded from a computer.

CompactFlash

MicroDrive

Memory Stick

Memory Stick PRO

Smart Media Card

xD Picture Card

Secure Digital Card (SD and SDHC)

MultiMedia Card

A regular memory card reader could be used in addition to a USB write-blocker to ensure that the data is viewed forensically. A write-blocker is a hardware device that allows an individual to read data from a device, like a hard drive, without writing to that device. An investigator could connect a media card reader to Digital Intelligence’s UltraBlock USB Write Blocker, which would be connected to a computer, where the media card’s contents would be viewed or acquired.

CDs were initially developed by Sony and Philips to store and play audio files. Later the CD-ROM was developed for data storage. A CD-R allows data to be stored once. Because a CD-R can only have data written to it once, handling this type of CD in a forensically sound manner does not require a write-blocker. A CD-RW, on the other hand, allows data to be written multiple times to the disc. Today a standard CD generally has a storage capacity of 700MB.

ISO 9660, introduced in 1988, refers to the standard for optical discs and their file system. ISO 9660 is also called CDFS (Compact Disc File System), and it was created to support different operating systems, like Windows and Mac OS. Other file systems can also be supported by CDs; however, these include Joliet, UDF, HSG, HFS, and HFS+. Joliet allows for longer filenames, which are associated with more recent versions of Windows. Because other file systems can exist on a CD, it is important to remember that a CD used in a Windows computer may show that it is invalid if an HFS+ file system resides on the disk. This means that specialized tools may be required to access the files stored on a CD. IsoBuster, for example, is a data recovery tool for CD, DVD, and Blu-ray. InfinaDyne’s CD/DVD Inspector is a specialized tool for a forensic acquisition of files from CDs and DVDs. It should be noted that an .iso file, which is an image of an optical disk, may be saved on the hard drive of a suspect’s computer or on another storage device.

The International Standardization Organization (ISO) in Geneva, Switzerland, has created this standard to facilitate the use of CDs on Windows, Macintosh, and UNIX computers. Frames consist of 24 bytes and are the smallest unit of memory on a CD-ROM. A sector on a CD-ROM consists of 98 frames (2352 bytes).

CnW Recovery is a tool that claims to recover disc data that has been through the quick erase process. Ultimately, when a quick erase has been performed, it is possible to recover the data on a CD-RW. When a full erase has been executed, the data cannot be recovered.

From a forensics perspective, Blu-ray discs have limited value because both the Blue-ray burner and recordable discs are still prohibitively expensive for the average consumer; a suspect is more likely to store video on a hard drive or burn video files onto a DVD. Nevertheless, there are two different recordable formats. A BD-R disc can be written to once, while a BD-RE can be used for re-recording.

Companies like Digital Forensics Systems produce devices for imaging and analyzing CDs, DVDs, and BDs.

IBM invented the floppy disk drive, which was used to store and read data from floppy disks.

Floppy disks have been largely replaced by flash memory, optical disks, and external hard drives. An investigator who encounters floppy disks during an investigation is more likely to find the PC-compatible 1440KB format. Floppy disks are formatted with the FAT12 file system. All of these disks will only have either one or two clusters.

A forensic image of a floppy disk can be made by using the following Linux command:

Click here to view code image

# dd if=/dev/fd0 of=/evidence/floppy1.img bs=512

In the previous command, “/dev/fd0” refers to the floppy disk drive. The “bs=512” refers to the block size (bs), which is 512K.

Of course, prior to inserting any disk you should make sure that the disk is set to write-protected. You should then make a bit-for-bit copy of the floppy disk and lock the original disk in an evidence locker away from any potential magnetic interference. To view the files on the disk, you can use the following command:

# ls /dev/fd0

The use of audio tapes in investigations has become less important. This is also true of video tapes used in a video cassette recorder (VCR).

Generally, data is recorded to a magnetic tape in blocks. Data at the block level can be accessed using the dd command. In computer investigations, dd is a UNIX command that produces a raw data image of a storage medium, like a hard drive or magnetic tape, in a forensically sound manner. The dd command is written in such a way that the image is copied to a hard drive, which allows for better search capabilities. A magnetic tape has no hierarchical file system because files are stored sequentially or in a tape partition. Partitions on magnetic tapes allow users to group files in “tape directories.” When a sector is only partially used by a file, the remainder of the sector is referred to as memory slack, buffer slack, or RAM slack. Similar to hard disks, file slack can contain remnants of data from previously existing files.

Hard disk drives are a primary source of evidence for investigators. There are different types of hard disk drives, which are mainly differentiated by their drive controllers and connections. There are Small Computer System Interface (SCSI) hard disk drives and Integrated Drive Electronic (IDE) hard disk drives, but more recently, Serial ATA (SATA) hard disk drives have become more prevalent. Hard disk drives are cloned rather than imaged when a hard disk drive needs to be copied quickly. Solid state drives have gained market share in recent times but present significant challenges for computer forensics investigators, given the unstable nature of these drives compared to traditional hard disk drives. Occasionally, an investigator will encounter a computer with multiple hard disk drives, which is referred to as a Redundant Array of Independent Disks (RAID).

USB thumb drives and other kinds of flash memory continue to grow in significance as they become cheaper and contain greater memory capacity. Interestingly, though, connecting these devices to a computer leaves a digital footprint in a (Windows) computer’s file registries, which the investigator then can view. This digital footprint is sometimes available on Macintosh and UNIX systems, too.

Boot Camp: A utility included with Mac OS X 10.6 (Snow Leopard) that enables a user to run the Windows operating system on an Intel-based Mac.

compact disc: A polycarbonate plastic disc with one or more metal layers that is used to store data digitally.

CompactFlash: A memory card that was first developed by SanDisk for use in portable electronics like digital cameras.

dd: A UNIX command that produces a raw data image of a storage medium, like a hard drive or magnetic tape, in a forensically sound manner.

Digital versatile disc (DVD): An optical disc with a large storage capacity that was developed by Philips, Sony, Toshiba, and Time Warner.

disk clone: An exact copy of a hard drive that can be used as a backup for a hard drive because it is bootable just like the original.

disk controller: Facilitates communication between a computer’s central processing unit (CPU) and hard disks (or other disk drives).

disk image: One file or a group of files that contain bit-for-bit copies of a hard drive but cannot be used for booting a computer or other operations.

eSATA: A variation of SATA that is used for external drives.

fault tolerance: If one component in a system, like a hard disk drive, fails, then the system will continue to operate.

File Translation Layer (FTL): Maps a logical block address to a physical block address.

FireWire: The Apple version of IEEE 1394, which is a serial bus interface standard for high-speed data transfer.

floppy disk: A thin, flexible, plastic computer storage disc that is housed in a rigid plastic rectangular case.

frames: Consist of 24 bytes and are the smallest unit of memory on a CD.

garbage collection: A memory-management process that removes unused files to make more memory available.

Host Protected Area (HPA): The region on a hard disk that often contains code associated with the BIOS for booting and recovery purposes.

Integrated Drive Electronics (IDE): A drive interface, largely based on IBM PC standards, for devices like hard disk drives, tape drives, and optical drives.

lands: The reflective surfaces on a CD burned flat by a laser.

magnetic tape: A thin, plastic strip with a magnetic coating that is used for storing audio, video, and data.

Memory Stick: Sony’s proprietary memory card that was introduced in 1998.

MultiMedia card: Storage memory that was developed by Siemens AG and SanDisk for use in portable devices, like cameras.

pits: The less reflective surfaces on a CD that have not been burned by a laser.

RAID (Redundant Array of Independent Disks): Two or more disks used in conjunction with another to provide increased performance and reliability through redundancy.

Random access memory (RAM): Volatile memory that is used for processes that are currently running on a computer.

Secure Digital card: A file storage device that was developed for use in portable electronics, like cameras.

Serial ATA: An interface that connects devices, like hard disk drives, to host bus adapters.

session on a compact disc: A group of tracks recorded at the same time.

Small Computer System Interface (SCSI): A protocol for both the physical connection of devices and the transfer of data.

solid state drive (SSD): A nonvolatile storage device found in computers.

table of contents (TOC): Records the location of the start address, the session number, and track information (music or video) on a compact disc.

track on a compact disc: A group of sectors that are written to at one time.

TRIM: An operating system function that informs a solid state drive which blocks are no longer in use, to allow for high write performance.

ware-leveling: The process by which areas of a storage medium become unusable over time.

write-blocker: A hardware device that allows an individual to read data from a device such as a hard drive without writing to that device.

xD (Extreme Digital) Picture Cards: Developed by Olympus and Fujifilm for digital cameras and some voice recorders.

zip disk: A removable storage medium that was developed by Iomega in the early 1990s.

2. What are the major challenges associated with removable memory that investigators face?

A. Actuator arm

B. ROM chip

C. Disk controller

D. FireWire

2. Which of the following is true of a disk clone?

A. It is a bootable copy.

B. It can be used as a hard drive backup.

C. Neither A nor B.

D. Both A and B.

3. Which of the following is true of solid state drives?

A. They have no moving parts.

B. Files are stored on metal platters.

C. It is volatile memory.

D. None of the above are true.

4. Which of the following is volatile memory that is used for processes that are currently running on a computer?

A. RAM

B. ROM

C. Hard disk drive

D. Flash

5. Which of the following refers to two or more disks used in conjunction with one another to provide increased performance and reliability through redundancy?

A. RAM

B. SCSI

C. IDE

D. RAID

6. FireWire is based upon which of the following standards?

A. 802.11

B. ANSI N42

C. IEEE 1394

D. ISO 9660

7. Which of the following memory cards is most likely to be found in Sony electronics?

A. Secure Digital Card

B. CompactFlash

C. MultiMedia Card

D. Memory Stick

8. The reflective surfaces on a CD burned flat by a laser are referred to as which of the following?

A. Lands

B. Pits

C. Mirrors

D. Craters

9. Which of the following is a high-capacity optical disc that can be used to store high-definition video?

A. CD

B. DVD

C. BD

D. VCD

10. Which of the following is a UNIX command that produces a raw data image of a storage medium, like a hard drive or magnetic tape in a forensically sound manner?

A. aa

B. bb

C. cc

D. dd

2. Integrated Drive ____ is a drive interface, connector, and controller, which is largely based on IBM PC standards, for devices like hard disk drives, tape drives, and optical drives.

3. ____ ATA is an interface that connects devices, like hard disk drives to host bus adapters.

4. A disk ____ is actually one file or a group of files that contain bit-for-bit copies of a hard drive but cannot be used for booting a computer or other operations.

5. The Host ____ Area is a region on a hard disk will often contain code associated with the BIOS for booting and recovery purposes.

6. ____ collection is a memory management process that removes unused files to make more memory available.

7. Fault ____ means that if one component in a system, like a hard disk drive, fails then the system will continue to operate.

8. A(n) ____ is a hardware device that allows an individual to read data from a device, like a hard drive, without writing to that device.

9. The less reflective surfaces on a CD that have not been burned by a laser are called ____.

10. A(n) ____ disk is a thin, flexible, plastic computer storage disc that is housed in a rigid plastic rectangular casing.