Note-8

Note-8 - CSE 494/598 Forensic Computing: Computer and...

Info iconThis preview shows pages 1–6. Sign up to view the full content.

View Full Document Right Arrow Icon
CSE 494/598 Forensic Computing: Computer and Network Forensics Prof. Gail-Joon Ahn IMPORTANT DATES ! Exam #1: Feb 19, 2009 ! Assignment #1: Mar 3, 2009 ! Spring Break: Mar 10 & 12, 2009 ! Exam #2: Mar 31, 2009 ! Class Project Due: Apr 23, 2009 ! Paper Report Due: Apr 28, 2009 ! Class Presentation: Apr 28 & 30, 2009 May 5, 2009 ! Exam #3 (Final): May 7, 2009 (12:10PM – 2:00PM) 2
Background image of page 1

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
3 Outline ! File Forensics ! Layers of analysis ! Data Organization ! How to manage ! How to store ! FTK Tutorial ! File Forensics (cont’d) ! Storage Media Analysis ! Volume Analysis Storage Media Analysis ! Data Storage ! To obtain a conceptual understanding of internals, not to fix hard disks ! Hard Disk Geometry ! Head – the device that reads and writes data to a drive ! Track – concentric circle on a disk platter ! Cylinder – a column of tracks on disk platters ! Sector – a section on a track
Background image of page 2
5 Storage Media Analysis (cont’d) Head Actuator Head Arm Chassis Disk Platter Storage Media Analysis (cont’d) ! Platters are divided into concentric rings called tracks ! Tracks are divide into wedge-shaped areas called sectors ! A sector typically holds 512 bytes of data 6 Tracks Sector
Background image of page 3

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
7 Storage Media Analysis (cont’d) http://www.pcguide.com/ref/hdd/geom/tracksZBR-c.html 9 sectors/track 16 sectors/track Storage Media Analysis (cont’d) ! A cylinder is a three- dimensional concept consisting of all tracks in the same position vertically 8
Background image of page 4
Storage Media Analysis (cont’d) ! Hard Disk Geometry (cont’d) ! Address Methods ! CHS Address (CHS-0,0,2) " 512 bytes per sector " X sectors per track " Y tracks per cylinder " Number of bytes on a disk = " Cylinders (tracks) x Heads (platters) x sectors
Background image of page 5

Info iconThis preview has intentionally blurred sections. Sign up to view the full version.

View Full DocumentRight Arrow Icon
Image of page 6
This is the end of the preview. Sign up to access the rest of the document.

This note was uploaded on 08/30/2009 for the course CSE 494 taught by Professor Rao during the Spring '08 term at ASU.

Page1 / 13

Note-8 - CSE 494/598 Forensic Computing: Computer and...

This preview shows document pages 1 - 6. Sign up to view the full document.

View Full Document Right Arrow Icon
Ask a homework question - tutors are online