Tag Archives: hard drive

Our first local ‘dead’ hard disk acquisition

We’ve imaged lots of removable media over the past year (~ 400, according to Victoria’s stats), and I’ve also done a  fair amount of forensic imaging of material on-site with donors (live acquisition) . One aspect of our ‘forensic’ armoury that has not been subject to so much testing is the imaging of whole hard disks at BEAM. So-called ‘dead’ acquisitions.

In the past few months two new accessions have presented us with an additional four hard disks. This is excellent news, as I have finally had the chance to use our forensic computer’s Ultrabay (write-blocking device) to image a real ‘collection hard disk’. Everything went smoothly. So far so good.

-Susan Thomas

Media Recognition – Hard Disk Drive part 3

Serial Attached SCSI (SAS) Interface

Type:

Magnetic storage media

Introduced:

2004

Active:

Yes [2010]

Cessation:

Capacity:

Varies, but majority do not exceed 300GB

Compatibility:

Compatible with all operating systems, though drives with a capacity of 137GB or more are only compatible with Windows 98 onwards and Mac OS 10.2 onwards. Not found on 8” or 5.25” drives.

Users:

Servers and high-end computers

File Systems:

FAT, NTFS, HFS/+, ext

Common manufacturers:

Western Digital, Seagate, Toshiba, Hitachi, Samsung

Recognition

SAS was born out of SCSI developments and entered the market in 2004. One feature making it preferable to SCSI is its higher transfer rate. Its fast speeds and high level performance make it suitable for high-end personal computer hard drives and servers. The first version was slower than the latest version of SCSI having a data transfer rate of 300 MB/s. However, in 2009 this rate increased to 600 MB/s and it is expected to reach 1200 MB/s by 2012. SAS uses point-to-point topology to connect the interface and can support multiple devices (up to 200), making it popular with servers. For the same reasons SAS hard disk drives are relatively expensive therefore they are not as common on standard personal computers as the more general purpose SATA interface.

The SAS connector is a 29-position connector. It is much smaller than its predecessor, SCSI, so as to be used on 2.5” drives. SAS connectors look similar to SATA connectors. The difference is that with the SATA interface the data and power connectors lie next to each other, but are separate, whereas with SAS the two form one connector, with a piece of plastic used to keep them distinct. This similarity is deliberate so that SAS connectors are compatible with SATA drives, but not the other way around.

 

External Hard Disk Drives

 

Early Apple Macintosh computers used external SCSI hard disk drives, despite internal hard disk drives being the standard for other PCs. More recently external hard drives are primarily used as additional storage devices.

Although the early Apple external drives were only compatible with Mac OS, later drives have been manufactured to support all modern operating systems. However, they cannot support any Windows OS preceding Windows 2000, Mac OS before version 8.5.1 or the Linux OS with a kernel earlier than version 2.4 unless updates are installed.

The hard disk in an external hard disk drive is no different to that in an internal drive, though an external drive is encased in plastic and the only visible part is the connector. This can either be a SCSI, eSATA, USB or FireWire connector.

FireWire (IEEE 1394): First released in 1995 this was originally developed as a replacement for the SCSI connector and many computers since 2003 have a built-in FireWire port, particularly Apple machines. FireWire has a higher transfer rate than USB and the latest version, FireWire 3200 has a rate of 393 MB/s, which also exceeds that of eSATA, although this rate varies with Windows OS. However it is more expensive than USB, hence it has never superseded USB’s popularity. It is compatible with Windows OS from Windows XP onwards, though issues with Vista have been raised. It is also compatible with Linux OS and Mac OS from version 8.6 onwards. The FireWire cables carry power and data on a single cable, therefore only one is needed for a device.

There have been several versions of FireWire each using different connectors. Here is a brief table setting this out:

Version Cable Used Date Introduced

FireWire 400 (IEEE 1394)

6-circuit

1995

FireWire 400 (IEEE 1394a)

4-circuit

2000

FireWire 800 (IEEE 1394b)

9-circuit

2002

FireWire S3200

9-circuit

2007

It is most common to find 6-cicuit connectors on desktop computers and 4-cicuit connectors on laptops. However, in 2000 amendments were made and the 4-cicuit connector was standardised resulting in more of these connectors being found on desktop computers.

FireWire 800 and 3200 are backwards compatible with these ports, but are manufactured with a 9-cicuit connector. Adaptors are available so that 9-circuit cables can be used with 4- and 6-circuit connectors on computers.

USB (Universal Serial Bus): USB was introduced in 1996 and has since become the dominant means to connect computer peripherals to the host controller. The original USB 1.0 has a transfer rate of 12 Mbits/s, which was increased to 60 MB/s (480 Mbits/s) by USB 2.0. This was released in 2000 and standardised in 2001. Like FireWire, USB connectors carry power as well as data, therefore do not require additional power cables.

There are several different USB cables available for different uses. The most common type found on computers is the A plug and port. A second type is similar in size and is usually found on extension cables. Mini plugs are also available for use with small devices such as cameras. The other sort is squarer and about half the width of the A plug. This is known as a B plug and is used on devices that use removable cables such as printers. Having two types of connector (A and B) prevents users accidentally creating an electrical loop.

eSATA: This is SATA’s own external connector introduced in 2004 with a transfer rate of 131 MB/s. Despite having a much larger data transfer rate, few computers have eSATA ports, favouring instead USB and FireWire.

-Victoria Sloyan

Media Recognition – Hard Disk Drives part 2

AT Attachment (ATA) Interface

Type:

Magnetic disk storage

Introduced:

1986

Active:

Only on existing computers

Cessation:

Almost completely superseded by SATA by 2007

Capacity:

750 GB

Compatibility:

Compatible with all operating systems, though drives with a capacity of 137GB or more are only compatible with Windows 98 onwards and Mac OS 10.2 onwards.

Users:

Desktop and laptop computers, particularly low-end ones. The primary interface used by IBM and adopted by Apple in 1994.

File Systems:

FAT, NTFS, HFS/+, CP/M, ext, MFS

Common manufacturers:

Present: Western Digital, Seagate, Toshiba, Hitachi, Samsung

Past: IMB, Apple, Sony, Hewell-Packard, Maxtor

Recognition

ATA, designed in 1986 was an evolved form of Western Digital’s original Integrated Drive Electronics (IDE). It was used for desktop and laptop computers. After the development of SATA in 2003 ATA became retroactively known as Parallel ATA (PATA).

Here is an example of an ATA interface. It is identified as ATA because of the rectangular 40-pin connector socket used. The second image shows the male connector.

 

 

The first ATA hard disk drive was used in the Compaq Deskpro 386. It had a transfer rate of 16 MB/s and a capacity of 128 GB. Later versions had larger transfer rates, though none exceeded 80 MB/s until 2005. Before the advent of SATA, ATA hard disk drives were popular with IBM PCs due to their low cost. ATA drives are also found on post-1994 low-end Apple Microsystems, the first being the Apple Quadra 630. In 1997 Apple also adopted ATA for their high-end machines starting with the Apple Powerbook G3. The ATA connector has a relatively short cable so ATA hard disk drives are commonly inbuilt.

 

Serial ATA (SATA) Interface

Type:

Magnetic disk storage

Introduced:

2003

Active:

Yes [2010]

Cessation:

Capacity:

Up to 2TB [2010]

Compatibility:

Compatible with at least one version of all major operating systems: supports versions of Windows after XP. Also, drives with a capacity of 137GB or more are only compatible with Windows 98 onwards and Mac OS 10.2 onwards. Unlikely to be found on 8” or 5.25” drives.

Users:

Servers, desktop and laptop computers. Adopted by IBM and Apple to replace ATA.

File Systems:

FAT, NTFS, HFS/+, ext

Common manufacturers:

Present [2010]: Western Digital, Seagate, Toshiba, Hitachi, Samsung

Past: Maxtor

Recognition

SATA was introduced in 2003 as a faster version of ATA and is used with desktops, laptops and servers. It was intended to replace ATA, and had almost completely done so by 2007. SATA uses AHCI (Advanced Host Controller Interface) and if a computer does not have it SATA runs in ATA emulation mode. This applies to Windows OS up to Windows XP, though Windows Vista and later versions support AHCI. Linux with a kernel version 2.16.19 onwards will support AHCI as will Solaris operating system.

The image below shows an example of a SATA interfaced hard disk. The manufacturer’s details are clearly displayed. This type of interface uses a different connector, which is more clearly visible in the second image.

 

The SATA interface uses a 7-pin connector and socket, as seen in the above image. SATA differs from its predecessors in that it has the option of two power sockets. There is the standard Molex power socket on the right, but SATA drives also have their own power socket. This is a 15-pin connector situated next to the data socket. The image below shows the reverse side of the hard disk drive. The data socket is on the left and the power connector is on the right.

The images below show the two male connectors, with the data connector first then the power connector.

Initially SATA had a transfer rate of 131 MB/s and the SATA revision 2.0 increased this to 300 MB/s. SATA is still currently being developed and the latest version released in 2009 has a transfer rate of 600 MB/s. External SATA hard disk drives often include their own eSATA connector. More information about this will be in the next post.

Small Computer Scientific Interface (SCSI) Interface

Type:

Magnetic storage media

Introduced:

1981 (under the name SASI)

Active:

Only on existing computers

Cessation:

Early twenty-first century

Capacity:

2 TB

Compatibility:

Compatible with all operating systems, though drives with a capacity of 137GB or more are only compatible with Windows 98 onwards and Mac OS 10.2 onwards.

Users:

Servers and primarily high-end computers. Used on all microcomputers until ATA established. Used by Apple for low-end machines until 1994 and high-end machines until 1999.

File Systems:

FAT, NTFS, HFS/+, CP/M, ext, MFS

Common manufacturers:

Present: Western Digital, Seagate, Toshiba, Hitachi, Samsung

Past: IMB, Apple, Sony, Hewell-Packard, Maxtor

Recognition

SCSI was introduced in 1981 under the name SASI (Shugart Associates System Interface). It was used with various operating systems including Microsoft Windows, Mac OS, Unix and Linux. However, as ATA gained popularity SCSI became associated more with high-end machines and servers. Even then SCSI began to lose popularity in the 1990s and was abandoned by Apple Macintosh in 1999. In the last decade provision for SCSI on motherboards has been largely discontinued with manufacturers preferring SATA and SAS.

The SCSI interface uses either a 68 or 80-pin connector (68-pin is more common) and a Molex power connector. The images below show the female and male 68-pin socket and connector.

 

The first SCSI interface had a transfer rate of 3.5 MB/s which soon increased to 5 MB/S. The rate increased in 1994, 1997 and again in 2003 to reach 320 MB/s.

-Victoria Sloyan

Media Recognition – Hard Disk Drives part 1

Inbuilt hard disk drives were first introduced in 1980. Most are labelled with the manufacturer’s name or logo and contain details of the disk model, though this isn’t always visible if the drive is in a casing.

There are four variables that can be used to classify a hard disk drive which are:

1. Form Factor (physical size)

2. Capacity

3. Compatibility

4. Interface – the main differentiator

Form Factors

Internal hard drives were initially sized to match floppy drive sizes and have a compatible interface.

 

 

8 inch: (241.3 x 117.5 x 164.1mm) Disk drives this size will not have a SATA or SAS interface, since 8” drives were discontinued by the time they were developed.

5.25 inch: (203 x 164.1mm x 82.8mm or 41.4mm) There are two heights available: full height (82.8mm) and half height (41.4mm). Half height is more common, but both were discontinued by the late 1990s. 5.25” drives are unlikely to have either a SATA or SAS interface, since they were not introduced until 2003 and 2004.

3.5 inch: (461 x 414 x 203mm)

2.5 inch: (69.85 x 7 x 100mm) Originally primarily used for portable machines such as laptops, though from 2008 it replaced 3.5” drives in PCs. Higher capacity drives are 12.5mm high rather than 7mm.

Smaller drives, including 1.8”, 1” and 0.85” exist and were used in portable devices like mobile phones and memory cards, but this ceased in 2009 due to the popularity of flash memory.

Capacity

 

The capacity of a hard disk drive is dependent on its form factor, year of manufacture and intended use (servers for example have much larger hard drives than those found in laptops).

Form Factor: 8” and 5.25” disk drives have smaller capacities than 3.5” and 2.5” drives because they were manufactured before the technology existed to store vast amounts of data. The table below illustrates the maximum capacities held by each form factor.

Form Factor

Maximum Capacity

Date

8”

20 GB

Full height 5.25”

47 GB

1998

Half height 5.25”

19.3 GB

1998

3.5”

2 TB

2009

2.5”

1 TB

2007

http://en.wikipedia.org/wiki/Hard_disk#Capacity_measurements

 

Be aware that these are the maximum capacities and actual drive sizes will vary widely. In part this is to suit the different budgets of consumers, but is also due to the technological abilities at the time of manufacture. For instance, 2.5” drives can reach 1 TB, but only since 2007, so no 2.5” drive manufactured before this will have a capacity this large. A brief chronology of size expansion may be useful:

1980: First hard drive disk has a capacity of 5 MB

1991: 2.5″ drive expanded to 100 MB

2005: First 500 GB drive available

2006: 750 GB drives introduced

2007: 1 TB 3.5″ and 2.5″ drives released

2009: 2 TB 3.5″ drives released

Despite 2TB and 1TB drives being available, most hard disk drives do not exceed 500GB.

 

The type and version of an interface used also has an impact on the maximum capacity. For example, the first ATA interface supports up to 137 GB, but version 6 (ATA-6) has a maximum capacity to 144PB, although disk drives don’t reach this size due to other technological limitations and the fact that it isn’t commercially viable. The SCSI interface could from the start support 2.2 TB and this increased to 9.44ZB in 2001, but again, hard disk drives are not actually manufactured in these sizes.

 

Compatibility

As a general rule all types of hard drive are compatible with the main operating systems. However, there are issues with larger capacity hard disk drives being compatible with older operating systems.

 

DOS systems generally cannot recognise drives larger than 8.4 GB and Windows 95 has a limit of 32GB. Windows 98 is restricted to 64GB, but this is not an operating system restriction, it is imposed by the Microsoft disk setup tools FDISK.EXE and FORMAT.COM.

The BIOS installed on a computer can also impact compatibility as pre-1998 BIOS cannot support drives larger than 8.4GB and pre-2002 BIOS cannot support drives larger than 137GB. However, this only affects ATA hard disk drives since the other types do not rely on BIOS for support.

 

Interface

The main difference between hard disk drives is the type of interface used. This connects the hard disk to the motherboard. The most common types are:

  • ATA (also known as IDE and PATA)
  • Serial ATA (SATA)
  • Small Computer Scientific Interface (SCSI)
  • Serial Attached SCSI (SAS)

All hard drives have two cables; one connects to the motherboard and the other to a power socket. The majority use the same power cable known as a Molex connector. There are several types, but the most common one used for hard disk drives is the Molex 8981 Series Power Connector. This has four conductors and the standard pin-out is yellow (+12 V), black (ground), black (ground) and red (+5 V).

 

 

 

-Victoria Sloyan