Hardware

Numbering Schemes

Before we continue, we need to do a quick review on numbering schemes: bit, byte, hexadecimal.

Bit is a single binary value: 0 or 1.

Byte is 8 bits.

Hexadecimal is a numbering system that is frequently used in Computer Science. Hexadecimal uses 16 unique symbols to represent values. The symbols are 0 - 9 and A - F. The A-F hexadecimal values represent the base 10 (decimal) values of 10-15. Each hexadecimal digit is equal to 4 binary bits, thus making it a great way to represent binary in an easier and more friendly method.

Untitled spreadsheet

Why does this matter?

During this course, we might be looking at data using a program that shows data in hex or we might need to anayze data that is shown in hexadecimal. it is important for us to understand this and be able to convert between each numbering scheme.

Hardware

During a forensic examination it is important to have some basic knowledge of hardware. This way you can have an idea of what you are looking at and what to expect.

Drive Types

There has been an increase on the types of drives that are available. Several years ago, we only really saw SATA Magnetic drives, but now we are seeing solid state drives, NVMe, M.2 drives as well. We are also finding SAS drives in various pieces of equipment. It is important to understand the type of drive you are dealing with, as you might need specialized hardware/tools to image it. Even though, below we are focusing on storage drives and connectors, do not forget about other drive types such as USB and optical! Also, sometimes vendors do not play nice and create propriety interfaces (I found this the case with older Apple products and their SSD drives).

SATA

SATA offers a high-speed interface to connect hard drives and SSDs. It replaced the older ATA standard and helped simplify cabling.

SAS

Serial Attached SCSI (SAS) is another high-speed interface to connect storage devices, but usually only found in enterprise systems. Be aware - it looks almost like SATA, but it differs!

SSD

This is a storage device that uses flash memory to store its data. SSDs offer a greater performance that traditional hard drives.

NVMe Drive

Non-Volatile Memory Express (NVMe) drives are a high performance SSD drive using PCIe interfaces.

M.2 Drive

M.2 drives are a small form factor drive that provide a high performance and can connect to either PCIe or SATA interaces.

SCSI

Small Computer System Interface (SCSI) this is a legacy interace that is not common anymore. It was used previously to connect hard drives and other various devices to computers.

Do not forget about all the other types of hardware

Mainboard
CPU
Firewire
PCMCIA
PCI Express
AGP
NIC

Google Sites

Report abuse