Lernkarten

Karten 10 Karten
Lernende 0 Lernende
Sprache English
Stufe Universität
Erstellt / Aktualisiert 20.06.2019 / 20.06.2019
Lizenzierung Keine Angabe
Weblink
Einbinden
0 Exakte Antworten 10 Text Antworten 0 Multiple Choice Antworten
Fenster schliessen

What are some types of modern storage?

  • Magnetic tape (cartridge)
  • Magnetic disks (hard drives)
  • Non-Volatile Memory (Flash, SSD, USB sticks)
  • Optical discs (CD, DVD, Blue-ray)
Fenster schliessen

Name some modern drive interfaces.

  • SATA - Serial ATA
  • SAS - Serial Attached SCSI
  • NVME - Non-Volatile Memory Express
Fenster schliessen

Name some common drive interface protocols

 

  • ATA Command Set (ACS) - uses registers
  • ATAPI commands - packet interface via ATA
  • SCSI commands - client/server (initiator/target)
  • USB BOT - Bulk Only Transport
  • USB UASP - USB Attached SCSI
Fenster schliessen

Name some common interface standards.

  • OS can have a stadard device driver for all devices
  • SATA - AHCI
  • USB - xHCI
  • NVME - NVME(NVMEHCI)
Fenster schliessen

What can you tell me about the sector sizes of magnetic disk drives?

Sector sizes:

  • Typical drives appear to have 512 Byte sectors ("512e")
  • There is an "Advanced Format" agreement by drive manufacturers
  • 512 byte sectors are just emulated, modern drives 4096 byte sectors
  • "4Kn" are drives with native sectors
Fenster schliessen

On a magnetic disk drive what is relevant to forensics?

  • "deleted" data on the platters
  • HPA - Host Protected Area
  • DCO - Disk Configuration Overlay
  • drive service area
  • ATA security (set of security featurs)
Fenster schliessen

What are the chalanges with non-volatile memory (flash drives)?

  • FTL - Flash Translation Layer
  • over-provisioned blocks
  • "chip-off"
  • TRIM commands
  • NVME and SATA Express are not the same.
Fenster schliessen

What are non standard ways to access a drive?

  • JTAG access to the drive electronics
  • TTL/serial access to drive electronics
  • Securtiy exploits to get access