Bruce Nikkel 1_4_storage_media.pdf

0.0 (0)

Fichier Détails

Cartes-fiches	10
Langue	English
Catégorie	Informatique
Niveau	Université
Crée / Actualisé	20.06.2019 / 02.07.2021
Lien de web	https://card2brain.ch/box/20190620_bruce_nikkel_14storagemedia_pdf
Intégrer	<iframe src="https://card2brain.ch/box/20190620_bruce_nikkel_14storagemedia_pdf/embed" width="780" height="150" scrolling="no" frameborder="0"></iframe>

Liste des carte

Étudier

What are some types of modern storage?

Commandes clavier:

= tourner,

= avant/arrière,

= faire défiler

Magnetic tape (cartridge)
Magnetic disks (hard drives)
Non-Volatile Memory (Flash, SSD, USB sticks)
Optical discs (CD, DVD, Blue-ray)

Name some modern drive interfaces.

Commandes clavier:

= tourner,

= avant/arrière,

= faire défiler

SATA - Serial ATA
SAS - Serial Attached SCSI
NVME - Non-Volatile Memory Express

Name some common drive interface protocols

Commandes clavier:

= tourner,

= avant/arrière,

= faire défiler

ATA Command Set (ACS) - uses registers
ATAPI commands - packet interface via ATA
SCSI commands - client/server (initiator/target)
USB BOT - Bulk Only Transport
USB UASP - USB Attached SCSI

Name some common interface standards.

Commandes clavier:

= tourner,

= avant/arrière,

= faire défiler

OS can have a stadard device driver for all devices
SATA - AHCI
USB - xHCI
NVME - NVME(NVMEHCI)

What can you tell me about the sector sizes of magnetic disk drives?

Commandes clavier:

= tourner,

= avant/arrière,

= faire défiler

Sector sizes:

Typical drives appear to have 512 Byte sectors ("512e")
There is an "Advanced Format" agreement by drive manufacturers
512 byte sectors are just emulated, modern drives 4096 byte sectors
"4Kn" are drives with native sectors

On a magnetic disk drive what is relevant to forensics?

Commandes clavier:

= tourner,

= avant/arrière,

= faire défiler

"deleted" data on the platters
HPA - Host Protected Area
DCO - Disk Configuration Overlay
drive service area
ATA security (set of security featurs)

What are the chalanges with non-volatile memory (flash drives)?

Commandes clavier:

= tourner,

= avant/arrière,

= faire défiler

FTL - Flash Translation Layer
over-provisioned blocks
"chip-off"
TRIM commands
NVME and SATA Express are not the same.

What are non standard ways to access a drive?

Commandes clavier:

= tourner,

= avant/arrière,

= faire défiler

JTAG access to the drive electronics
TTL/serial access to drive electronics
Securtiy exploits to get access

What are some forms of self encrypting drives?

Commandes clavier:

= tourner,

= avant/arrière,

= faire défiler

SED - Self Encrypting Disk
Some USB drives have passwords/PINs
OPAL
Shadow MBR

Can't forensically image a locked OPAL SED

What are some operating system full disk encryptions? (FDE)

Commandes clavier:

= tourner,

= avant/arrière,

= faire défiler

MS Bitlcoker
Apple FileVault
Linux LUKS

Can forensically image OS based FDE (but sectors/blocks are encrypted)

1 / 10

Liste des carte

Étudier

Bruce Nikkel 1_4_storage_media.pdf

Créer ou copier des fichiers d'apprentissage

Créer ou copier des fichiers d'apprentissage

Connecte-toi pour voir toutes les cartes.

SWITCHaai

Office 365

Edulog

Apple ID

Google