Did you know that potentially 30% of the hard drive you are examining is not in the image you are making? What? вЂњI imaged the entire drive from beginning to endвЂќ. So letвЂ™s look at some new concepts and throw a wrench in our thought process. THIS PROBLEM IS BROUGHT TO YOU BY THE LETTERS вЂњPвЂќ AND вЂњGвЂќ These are both logical constructs of the user data area and not the physical geometry of the hard disk drive.

This issue has been addressed and discussed in multiple forums and wonвЂ™t be discussed here. The HPA and DCO can be used to set the user accessible size of a hard drive, effectively hiding areas of the disk from untrained investigators.

So those of you who do true data recovery on hard drives are going вЂњYa so, I knew thatвЂќ, however, many in the digital forensics field have not been taught these physical structure details, nor do most digital forensics examiners have access to or even know about a PC-3000 (the PC-3000 is a specialized data recovery tool designed for the recovery of data from drives) or similar tools and their capabilities.ДonвЂ™t confuse the hidden area on a hard disk drive that we are describing with an HPA (Host Protected Area), a DCO (Drive Configuration Overlay) or separate partition. Using GoogleвЂ™s advanced search feature simply search for вЂњlogical block addressing computer forensicsвЂќ to find any number of PowerPointвЂ™s describing the LBA process. With that physical description we then use the image as the foundation upon how we determine the location of data on a hard drive (by LBA or Logical Block Address, a scheme used for specifying the location of blocks of data stored on computer storage devices) and then use that data to interpret a userвЂ™s behavior. Some slides will even describe in detail how the head assembly writes the ones and zeros to the disk surface.

We all have seen the slide with the open hard disk drive case showing the platter, heads and spindle. Often the same or similar slides are used throughout these courses to describe the physical and mechanical parts of a hard disk drive. The description of the fundamentals of hard drive operation and hard drive imaging is taught in every basic forensic course. The issue for this paper is what is вЂњuser accessibleвЂќ and what additional data on the hard disk drive is there and what doesnвЂ™t get imaged. The tools work and do acquire that repeatable image of the user accessible data on the hard drive. All of this as we know it is accurate and true. We read and reference the NIST projects that review the imaging tools and substantiate their ability to acquire a вЂњforensicallyвЂќ sound image of the hard drive. We test the veracity of each of the tools we use. We all use the standard industry forensic imaging tools available to us. Certainly with live system analysis and cell phones the concept of repeatable imaging has been changed, but with a hard drive the basic tenant of вЂњmake no changesвЂќ to the hard drive is still the watch word for dead system imaging and an analysis. With no forensic image we have no verifiable evidence. Since the beginning of computer forensics, which has morphed into the broader field of вЂњdigitalвЂќ forensics, the industry has espoused that imaging is the foundation of everything we do. On the contrary, what we want to do is tell a tale of data not known is data not seen or in our case imaged. Now, we are not intending to imply that every case that was ever testified about by a digital forensic examiner should be reopened and the testimony thrown out. That concept is drilled into digital examiners in every class, vendors have built tools around that concept and the National Institute of Technology and Standards (NIST) has built a whole department (website included) around proving the science of hard drive imaging.Д«ut what if all of this was not correct? What if you testified in court, вЂњI imaged the entire drive and verified the process by producing a hash value that matched the original evidence.вЂќ, and this statement is not entirely accurate. It has been articulated by many, including us, that we вЂњforensicallyвЂќ image a hard drive to get that вЂњBit for bitвЂќ image of the ENTIRE contents of a hard drive. Imaging of hard drives has been the main stay of the вЂњScienceвЂќ part of digital forensics for many years. (A complete copy of this white paper and its figures and diagrams can be found at WHAT WE HAVE BEEN TAUGHT

Describe hard disk drive encryption.