1
00:00:00,080 --> 00:00:01,430
Hard disk drives.

2
00:00:01,520 --> 00:00:07,220
Now that we've had a good look at non-volatile storage, including tape and flash storage, let's go

3
00:00:07,220 --> 00:00:09,980
a bit deeper into the world of hard disk drives.

4
00:00:10,010 --> 00:00:13,670
Heads which serve as fixed storage media.

5
00:00:14,030 --> 00:00:19,850
I'll try to keep things simple and short by focusing mainly on the knowledge necessary for forensics

6
00:00:19,850 --> 00:00:26,420
investigators in particular, HDD technology has certainly come a long way from the monstrous storage

7
00:00:26,420 --> 00:00:33,620
devices first seen in IBM mainframes and is now more compact, fast and affordable with capacities in

8
00:00:33,620 --> 00:00:34,610
the terabytes.

9
00:00:34,640 --> 00:00:40,340
Although the newer, solid state drives use the same type of memory found in flash memory devices,

10
00:00:40,370 --> 00:00:44,020
they are still a bit costly when compared to mechanical drives.

11
00:00:44,030 --> 00:00:50,240
This may be perhaps one of the contributing factors to why older mechanical drive technology is still

12
00:00:50,270 --> 00:00:51,170
being used.

13
00:00:51,200 --> 00:00:57,530
Mechanical drives consist of moving parts, including platters and actuator arm and a very powerful

14
00:00:57,530 --> 00:00:58,280
magnet.

15
00:00:58,490 --> 00:01:04,380
Although it is very common to still find these mechanical heads in today's laptops and hard drives,

16
00:01:04,380 --> 00:01:10,320
they are much slower than the newer, solid state drives which have no moving parts and look very similar

17
00:01:10,320 --> 00:01:13,110
to the chipset of a USB flash drive.

18
00:01:13,140 --> 00:01:19,800
In your forensics investigations and adventures, you may come across or be presented with older HDDs

19
00:01:19,800 --> 00:01:25,320
that can have different interfaces and use different cable technologies to connect to motherboards.

20
00:01:25,350 --> 00:01:27,360
Let's have a look, shall we?

21
00:01:27,660 --> 00:01:28,320
ID.

22
00:01:30,120 --> 00:01:37,410
Many of the first PCs in the mid 1980s were outfitted with hard drives that used parallel advanced technology

23
00:01:37,410 --> 00:01:41,340
attachment Pata and integrated drive electronics.

24
00:01:41,370 --> 00:01:41,940
I'd.

25
00:01:42,800 --> 00:01:46,430
Technology, as with all older devices back then.

26
00:01:46,460 --> 00:01:51,530
Parallel transmission was the order of the day, allowing for very limited throughput.

27
00:01:51,560 --> 00:01:58,130
An easy way to identify older drives is to simply have a look at the interface where the data and power

28
00:01:58,130 --> 00:02:00,110
cables connect to the drive.

29
00:02:00,410 --> 00:02:06,650
These older drives, as in the following photo, have four pins for power which connect to a molex connector

30
00:02:06,680 --> 00:02:13,310
separated by eight pins used to set the device as a master or slave device and then 40 pins for the

31
00:02:13,310 --> 00:02:17,270
ID data cable, which transmits the data to the motherboard.

32
00:02:17,300 --> 00:02:26,180
In 1994, advancements in technology led to the release of enhanced Integrated Drive Electronics IDE,

33
00:02:26,480 --> 00:02:33,020
which saw an increase in the number of pins for the data cable from 40 to 80, also increasing the transmission

34
00:02:33,020 --> 00:02:37,520
speeds from four maps to a possible 133 maps.

35
00:02:38,180 --> 00:02:47,220
ID ID was still, however, limited to a maximum of four ID slash IDE drives per computer as the jumper

36
00:02:47,220 --> 00:02:54,450
pins on the drive only allowed for two primary and two secondary drives set in a master slave configuration.

37
00:02:54,750 --> 00:03:03,660
Consideration also had to be given to the fact that R1 and R2 devices and Dvd-rom and R2 devices were

38
00:03:03,660 --> 00:03:07,860
also using IDE slash IDE technology at that time.

39
00:03:08,190 --> 00:03:10,110
Sata HDDs.

40
00:03:10,260 --> 00:03:16,620
In 2002, Seagate released an HDD technology called Serial Advanced Technology.

41
00:03:17,310 --> 00:03:24,810
Attachment Sata, which used serial transmission instead of slower parallel transmission, while Pata

42
00:03:24,810 --> 00:03:30,000
drives speeds of 3366 133 maps.

43
00:03:30,270 --> 00:03:36,100
Sata boasts speeds of 150/300 slash 600 maps.

44
00:03:36,120 --> 00:03:44,250
This meant that the lowest Sata transmission speed of 150 maps was faster than the highest pata speed

45
00:03:44,250 --> 00:03:46,650
of 133 maps.

46
00:03:46,800 --> 00:03:52,710
The connector interfaces of the Sata drives were also different, but it was common at the time to see

47
00:03:52,770 --> 00:03:59,970
Sata drives with connectors for both Sata and Pata power cables for backward compatibility.

48
00:04:00,300 --> 00:04:07,020
Sata data cables are much thinner than Pata cables as they only contain seven wires connecting to seven

49
00:04:07,020 --> 00:04:07,800
pins.

50
00:04:08,160 --> 00:04:11,070
Sata devices use one cable per drive.

51
00:04:11,100 --> 00:04:21,700
Unlike Pata Evices which connect to drives on one ide ide cable connected in a master slave configuration.

52
00:04:21,850 --> 00:04:28,570
The following photo shows an older ATI drive with Sata data and power connectors to the right and the

53
00:04:28,570 --> 00:04:32,740
legacy IDE Molex Power cable four pins to the left.

54
00:04:33,100 --> 00:04:39,820
Sata still continues to be the standard today for drive technology for both desktops and laptops, and

55
00:04:39,820 --> 00:04:42,520
has had several revisions as listed here.

56
00:04:42,640 --> 00:04:48,880
Speeds listed are in megabytes per second and not maps megabits per second.

57
00:04:49,840 --> 00:04:55,780
Sata 1 to 150 amps as ATA 2 to 300.

58
00:04:55,780 --> 00:04:59,650
Nanos Sata 3 to 600 Mbps.

59
00:04:59,800 --> 00:05:05,140
The following photo shows two Sata laptop, 2.5in drives.

60
00:05:05,260 --> 00:05:10,930
The one to the left is damaged and has been opened for us to see the circular platter at the middle

61
00:05:10,930 --> 00:05:17,350
with the actuator arm at the top slightly positioned over the platter at the end of the actuator arm

62
00:05:17,350 --> 00:05:23,110
is a read write head, which actually does the reading and the writing of data to the platter.

63
00:05:23,380 --> 00:05:28,720
The drive on the right hand side in the photo is actually a hybrid drive or a solid state.

64
00:05:29,360 --> 00:05:31,390
Hybrid drive SSD.

65
00:05:31,790 --> 00:05:37,820
This is actually a mechanical drive like the one to the left, but also has flash memory in it to allow

66
00:05:37,820 --> 00:05:40,730
for faster access to the data on the Platters.