Download - Foreign Military Studies Office - U.S. Army

Physical level analysis of a computer hard disk or other media is
conducted regardless of whether the disk is formatted for Windows, Macintosh,
or Unix. Such analysis and processes look directly at the physical disk at the
sector level. No interpretation of the file system takes place. An operating
system and specifically that operating system’s file manager program arranges
and tracks these sectors into a file system. Usually this file system keeps
metadata about the data stored on the hard drive to find it easily. This metadata
is a mixture of directory information, location information, and file attribute
data.
Physical level analysis includes the following:
• Bit-for-Bit Copy – This creates an exact duplicate of the computer
media. This method copies the media at the physical level from the
starting sector of the computer media (such as a hard disk) to the
ending sector of the disk (regardless of whether the sector is in use
by a file or not).
• File Header Searches – This search uses a program that starts at
physical sector 0 and looks for key strings that are known file
headers (GIF87, JFIF - for some graphic file types).
• String Searches – Examiners search at the physical level or within
the file system for a listing of keywords to the investigation. Encase
and DiskSearch Pro are examples of programs that do this. The
string search starts at sector 0 and looks for particular strings (for
example, the words cocaine, coke, hash, etc.).
• Regular Expression Searches – This type of search utility helps
an examiner find data that has some type of expression that is
consistent but may not be a consistent string of characters. An
example would be an email address. The consistent part of an email
address is the “@” followed by a string of characters followed by a
period followed by the rest of the domain name.
• Maintenance Tracks or Other Areas of the Physical Disk Not
Addressed by the File System – A maintenance track is placed on
the disk by the hardware manufacturer. It contains specific data
about a disk when the hard disk is made. Special software tools are
needed to read or write information to these tracks, and law
enforcement must have access to such tools.
• Recovering Sectors Marked as Bad – When a hard disk is
formatted, the formatting routine conducts a read/write test on each
sector to ensure that it can be utilized by the file system. If this test
fails, the routine can mark the sector as bad and tell the file system
to skip this sector. There are also other utilities that can mark
320