Five on Forensics Page 1 - Craig Ball

<strong>Five</strong> on Forensics
© 2002-2008 Craig Ball All Rights Reserved
Formatting and Partitioning
There is a fair amount of confusion—even among experienced PC users—concerning
formatting and partitioning of hard drives. Some of this confusion grows out of the way
certain things were done in “the old days” of computing, i.e., fifteen years ago. Take
something called “low level formatting.” Once upon a time, a computer user adding a new
hard drive had to low-level format, partition, and then high-level format the drive. Low level
formatting was the initial “carving out” of the tracks and sectors on a pristine drive. Back
when hard drives were pretty small, their data density modest and their platter geometries
simple, low level formatting by a user was possible. Today, low level formatting is done at
the factory and no user ever low-level formats a modern drive. Never. You couldn’t do it if
you tried; yet, you will hear veteran PC users talk about it still.
For Windows users, your new hard drive comes with its low level formatting set in stone. You
need only be concerned about the disk’s partitioning into volumes, which users customarily
see as drive letters (e.g., C:, E:, F: and so on) and its high level formatting, which defines the
logical structures on the partition and places at the start of the disk any necessary operating
system files. For the majority of users, their computer comes with their hard drive partitioned
as a single volume (universally called C:) and already high level formatted. Some users will
find (or will cause) their hard drive to be partitioned into multiple volumes, each appearing to
the user as if it were an independent disk drive. From the standpoint of computer forensics,
perhaps the most important point to remember about FAT partitions is that they come in three
different “flavors” called primary, extended DOS and logical. Additionally, the primary
partition can be designated “active” and “inactive. Only one partition may be designated as
active at any given time, and that partition is the one that boots the computer. The forensic
significance is that inactive partitions are invisible to anyone using the computer, unless they
know to look for them and how to find them. Inactive partitions, then, are a place where
users with something to hide from prying eyes may choose to hide it. One simple way to find
an inactive partition is to run the FDISK command if the system uses DOS or Windows
95/98/ME. If the system uses Windows Vista, XP, NT or Windows 2000 don't use FDISK.
Instead, use Disk Management, an enhanced version of FDISK, but BE VERY CAREFUL!
You can trash a hard drive in no time if you make a mistake with these utilities.
Cluster Size and Slack Space
By way of review, a computer’s hard drive records data in bits, bytes and sectors, all physical
units of storage established by the hard disk drive’s internal geometry in much the same way
as the size and number of drawers in a filing cabinet are fixed at the factory. Sticking with the
file cabinet metaphor, bits and bytes are the letters and words that make up our documents.
Sectors (analogous to pages) are tiny segments of thousands of concentric rings of recorded
data. A sector is 512 bytes, never more or less. A sector is the smallest individually
addressable physical unit of information used by a computer. Computer hard drives can only
“grab” data in sector-size chunks.
A common paper filing system uses labeled manila folders assembled into a “red rope file” or
master file for a particular case, client or matter. A computer’s file system stores information
Page 21