Five on Forensics Page 1 - Craig Ball

<strong>Five</strong> on Forensics
© 2002-2008 Craig Ball All Rights Reserved
crashes are increasingly rare events even as
the tolerances have become more exacting.
To appreciate the fantastic tolerances required
for achieving this miracle, consider Fig. 7. A
human hair is some 6,000 times thicker than
the flying height of a modern hard drive
read/write head! No wonder hard drives must
be assembled in “clean rooms” with specially
filtered air supplies.
Sectors, and Clusters and Tracks, Oh My!
Now it starts to get a little complicated, but stay
with me because we’ve nearly unraveled the
mystery of latent data. At the factory, platters
are organized into specific structures to enable
the organized storage and retrieval of data.
This is low level formatting, dividing each
platter into tens of thousands of densely
packed concentric circles called tracks. If you
Figure 8
could see them (and you can’t because they are nothing more than microscopic magnetic
traces), they might resemble the growth rings of the world’s oldest tree. It’s tempting to
compare platter tracks to a phonograph record, but you can’t because a phonograph record’s
track is a single spiraling groove, not concentric circles. A track holds far too much information
to serve as the smallest unit of storage on a disk, so each one is further broken down into
sectors. A sector is normally the smallest individually addressable unit of information stored on
a hard disk, and holds 512 bytes of information. The first PC hard disks typically held 17 sectors
per track. Figure 8 shows a very simplified representation of a platter divided into tracks and
sectors. In reality, the number of tracks and sectors is far, far greater. Additionally, the layout of
sectors is no longer symmetrical, to allow the inclusion of more sectors per track as the tracks
enlarge away from the spindle. Today's hard disks can have thousands of sectors in a single
Page 17