Physical Storage Artefacts in Magnetic Media

Question 1

Modern disks contain both a separate operating system and typically also a management interface which can be interrogated:

Answer 1

• These tools and statistics can provide useful evidence in their own right
• More interesting both from forensic and counter-forensic viewpoint: Modification of disk firmware
• This can allow access to bad blocks or other internal structures that would otherwise be unavailable even to a hardware-based imaging tools

Question 2

For situations where it is not possible to gain access to the device firmware or if a disk is damaged physically/electronically, further recovery options exist:

Answer 2

• In case of electronics failure, relevant components can be transplanted from a donor drive
• Defective mechanical components can often also be replaced

Question 3

Physical Destruction - Smleting platters is one option, the Curie point of magnetic materials used in modern hard disks can be quite high:

Answer 3

• In case of an aluminium substrate the platter would melt before paramagnetisation is achieved

Question 4

Phycial Destruction - Fire-damaged disk…

Answer 4

Platters may still be readable, e/g/ in case of glass platters

Question 5

Physical Destruction - Liquid damage will affect…

Answer 5

Circuits and may saturate the breather hole, but after full immersion, different damage patterns may arise

Question 6

Even where damage is extensive, data can still be recovered by:

Answer 6

• Platters can be placed on a spin stand
• Scanning electron microscopes can be used to detect magnetisation
• Similarly, magnetometers, magnetic force microscopy and magnetoresistance measurement can provide relevant data
• Optical detection of electromechanical deflection can detect even negligible magnetisation

Question 7

Counter-Forensics - Destroying magnetic media disks to prevent recovery can take different forms. Degaussing equipment is useful only for:

Answer 7

Older hard disks and magnetic tape media

Question 8

Even small fragments left by crushing/shredding may allow partial recovery - hence chemical destruction or small particle sizes may be required, this also applies to optical equipment:

Answer 8

• For optical disks, simply burning the medium may suffice provided toxic fumes are dealt with
• For hard disks, the glass/ceramic platters and materials involved require very high temperatures, making chemical disposal more practical