Title: 4. Understanding Other Disk Structures
Course: IN 2005 Digital Forensics > Section: Module 8: Chapter 8 - Macintosh and Linux Boot Processes and File Systems

Understanding Other Disk Structures

1. This section deals with SCSI, IDE/EIDE and SATA drives.

Examining CD Data Structures

1. See Figure 8-21 to view the different layers that constitute all kinds of CDs including CD-R and CR-RW.
2. See Figure 8-22 to view the surface organization of a CD. Data is configured into three regions: lead-in area, program area and the lead-out area.
3. The reading methods (CLV and CAV) are for CD devices.
4. DVD disk file structures use a Universal Disk Format (UDF) called Micro-UDF (M-UDF).  For backward compatibility, some DVDs have integrated ISO 9660 to allow compatibility with current Oss.

Examining SCSI Disks

1. Highlight requirements for connecting SCSI devices such as:
  - Cards
  - Cables
  - Adapters
  - Terminators
  - Drivers
2. The Advance SCSI Programming Interface (ASPI) provides several software drivers for communication between the OS and SCSI component.
3. Newer SCSI devices typically use an integrated self-terminator.  But, one problem with older SCSI drives is identifying which jumper group terminates and assigns a port number.

Examining IDE/EIDE and SATA Devices

1. Current technologies to connect IDE/EIDE devices to PC systems and the problems that they can cause during an investigation. Remind your students that CMOS on current PCs identifies proper disk settings, and this creates problems if an investigator tries to connect an old IDE device to a new forensics workstation.
2. Some of the possible solutions to this problem:
  - Disk imaging tools
  - Getting an old PC
  - Cards and adapters
3. A brief history of the protected areas introduced in 1998 by ATAPI-5 and mention several tools that can access these reserved areas.
4. HPA is also referred to as a BIOS Engineering Extension Record (BEER) data structure.
5. One trick suspects use to conceal evidence is hiding disk partitions.  Norton Disk Edit can be used to change the disk partition table so there’s no indication that the deactivated partition exists.
6. You should use imaging tools that can access unpartitioned areas of a drive.