Digital Forensics

This article discusses the workings of hard drives, issues with SSD drives, data recovery from damaged drives, fragmented data, and water damage to electronic components. It also explores methods of recovering data from water-damaged hard drives and the importance of having a backup of data.

Running head: DIGITAL FORENSICS
Digital Forensics
Name of the Student:
Name of the University:
Author Note

1
DIGITAL FORENSICS
1. How does a hard drive work. Describe the components and their job. Can we read
electron alignment on a drive with an electron microscope (we can) but will the zeroes and
ones be useful or are they encoded? Then discuss ssd drives. How do they work? Issues
such as electrical components that may not be able to be swapped. Can we take a chip off a
damaged board and solder it on to an identical board and read the data?
Hard Drive Workings
In the hard drive, there is not any iron nails, rather it has “shiny, circular "plate" of
magnetic material called a platter, divided into billions of tiny areas.” These areas have the
capability to be magnetized and demagnetized independently, in other words it can store one and
zero (Tomer et al., 2017). Magnetism is being used for the storage of data in manner to allow
hard drive to store data even if, there is not any power in it.
Hardware Components
There are four major components of the hard drive those can be presented as:
Platters: It has been the circular discs, where 0s and 1s are stored for the files being
stored.
The Spindle: It keeps the platter in its location in manner to allow platters to rotate in its
position (Shu et al., 2017).
Read or write Arm: it controls the read or write heads that is the actual one responsible
for reading or writing data.
Actuator: It has been a small motor allowing motion and movement to the read/write arm
after taking commands from the circuit board of the hard drive.

2
DIGITAL FORENSICS
Other components: front-end circuit board, casing, ports, and other components hold the
small components of the hard drive (Bos, 2017).
Electron alignment on hard drive
Yes, electron alignment can be done on the drive in manner to secure the hard drive. For
the deletion of every data from the drive securely, it is necessary to change the magnetic value of
the drive with 0s. It will helpful in blocking an individual to access the data or information
previously saved in the drive (Schatz, 2017). It is the major concerning point that the drive
should contain some 1s value in the drive as if, the whole data has been stored in 0s value, it
becomes almost impossible to retrieve data from the drive. However, there are specialist
equipment, those can be possible in retrieving data from the hard drive. It will become essential
to write random pattern in the same location, followed by the zeroing pass. Dewald and Seufert
(2017) stated that “there are other techniques to securely erase a CMOS / SSD but that involves
overpowering the 'memory' cell to erase all values inside it.”
2. Then move on to damage to drives. How easily can we retrieve deleted data (usually
trivial). What about if some bits are missing. Do we end up with a partially complete jpeg
for example of can we not read the jpeg at all. How do we know what the file should be?
(magic numbers or more correctly file signatures).
SSD drives and working
SSD (Solid-State Drive) stores data using semiconductor chips, despite of using magnetic
media. The chips being stored in the SSD is responsible for delivering non-volatile memory in
manner to manage the stability of the data even there is no power (Freiling Glanzmann & Reiser,
2017). It has never been established in the motherboard; rather it has been placed separately in

3
DIGITAL FORENSICS
the computer as a part of the computer. It allows the user to remove the drive from the computer
without handling with secured elements of the computer (Robins, Williams & Sansurooah,
2017). It uses the same memory as that of the RAM called “Flash” and the difference is only that
it keeps the data stored even if there is no power in the system.
Issues in SSDs
Wear leveling can be greater concern with the SSD because of two reasons; firstly, there
are the possibilities of getting different hash values every time during imaging the solid-state
drive. The mathematical algorithms or the hash values could be represented through a string of
letters and numbers those have been uniquely assigned to the set of the data, very similar to the
digital fingerprint (Prem, Selwin & Mohan, 2017). These hash values can be utilized for
verifying the “exact, bit for bit, copy of the original data prior to analysis, the original hash value
of the data, and the copy, should be the same.” Second reason is that,; there are many obstacles
in recovering the deleted files and could become impossible to recover it. The data those are
necessary might be appearing at random location within the array of the memory regardless of
the fact the location of the data should be (Abdi, 2017). The reasons behind this could be the
over provisioning and wear leveling.
In the present time, researches are being made for the solution of these issues. The known
“Department of Homeland Security’s Science and Technology Directorate, Cyber Security
Division” for the funds and additional support in this context is delivering the research and
investigations (Nemetz, Schmitt & Freilling, 2018). Theoretically, there are many solutions for
the elimination of these problems however, in practical life none of the theoretical context meet
the requirement of the identified issues.

4
DIGITAL FORENSICS
Memory swapping
It is possible to read and retrieve data through soldering the identical chip on other board
and it can also be helpful in recovering the flash memories. In the present day, almost every chop
has been packed in a micro BGA or a TSOP casing and it could be accomplished through de-
soldering and using it in an efficient and effective manner despite of losing data. BP 1600 chip
programmer can be utilized for reading the flash memory to recover the data of the flash memory
(Lee et al., 2017). There will be the need of drivers for each type of memory chip and it can be
listed n the disadvantages.
Data Recovery from Damage Drive
The easiest way can be the application of file recovery software that can be represented
as a cost-effective and simple solution for recovering the deleted files. This will be helpful in
recovering the files without any mess and will be much safer (Pyo, Lee & Lee, 2017).
3. Then talk about fragmented data. How is it stored and how does the drive piece it back
together as one file. What implications does this have for a faulty or damaged drive?
Fragmented Data
For some of the cases, the file systems of the operating system that is a data file of more
than a fixed size has been stored in the several fragments or chunks in place of the single
contiguous bits sequence at a single storage space within the hard drive. This can be utilized for
recovering data even if the file has been deleted from the drive through some if the unused
sections of the storage where, the previous data or file had been stored (Boss et al., 2017).
Fragmentation over time can result in slow access to the data because of the condition that each
file must be accessed for considering the whole file in manner to read in. the user can utilized for

5
DIGITAL FORENSICS
the data recovery through the process of defragmentation. Consolidation or defragmentation of
the space available in the hard drive has been one of the better approach for the prevention
techniques. Johnson et al. (2017) “when free space is in large contiguous blocks instead of
scattered around the hard drive in smaller sections, new files that get written to the hard drive can
be easily placed in one piece”. “When rewriting files during disk defragmentation, defraggers try
to place all files closer together so that the remaining free space is consolidated into larger
sections (Abeykoon & Feng, 2017).”
4. Then talk about water and what issues it causes with electrical components. What
happens to a circuit board - copper tracks, microchips, resistors. Are they damaged by
water. How are they damaged - rust, corrosion, shorting out components.
Electronic components when exposed to water can be easily damaged and there are
various type of issues that take place if the components are exposed to water. According to Jin
(2017), energy is an essential element of the human social activities. Some important factors
regarding the Lithium-ion batteries and the adverse effects of it when exposed to water has been
provided here in this article. From the article can we can very easily understand that the batteries
are critically damaged in case they come in contact with water and can catch fire easily. In
addition to this, apart from the Lithium-ion batteries other electronic device might also face
various critical conditions. Pure water is a very poor conductor of electricity, but when it
contains ions (sodium and chloride), it can act as a good conductor of electricity. So, if this ion-
filled water comes into contact with any electronic device in ON state, it is going to make
connections in places, where there should be no connection resulting in large current which in
turn damages the circuit (Sprecher, Kleijn & Kramer, 2014). Water can cause a short circuit in
devices not designed to cope with a conductive liquid. Water contaminated with minerals, dirt,

6
DIGITAL FORENSICS
etc. will conduct. It won’t be a perfect conductor, but it will conduct. This can cause shorts,
which in turn causes too high a current to go in places where it shouldn’t, and this is what can
destroy electronics. Many electrical devices work fine in water, but they are designed to do so,
for instance subversive electrical water pumps, undersea cables, kettles etc. Many electronic
devices require very low currents, and shorting those makes they stop. Some older devices had
higher currents, and could actually fry the components, but modern devices don't do this as
much. In case the device is in the OFF state and water is spill on it the device will keep on
working if dried up on time before turning it to on state as dried water can no longer make any
undesired connections. However there are other factors that might rise up in this situation. One
of the very important factor is corrosion. Water in the form of condensation can also be a
problem, particularly with regard to corrosion, and some electrical devices that are otherwise
unaffected by water mat crack when exposed to cool water, for instance a hot heat sink, due to
rapid uneven cooling Corrosion happens on long term exposure with water. The connections
between different devices is done using metal. When metal comes into contact with water, it
starts corroding and converting to another non-conducting compound. Since the water contains a
lot of ions, it speeds up the process of this corrosion (). In places with salty water (including
coastal regions), things corrode very fast. Once the metal connection between two parts of the
circuit is sufficiently corroded, the connection is broken and electronic device stops working.
Conversely, There are several electrical devices that will be damaged if not exposed to water
such as those used to boil water. And the conductive nature of water is used in some circuits,
particularly in power transmission across oceans where there is only one conductive cable.
Devices can be submerged in pure water and not an effect would take place to the device. Pure
water is a very poor conductor, so it won’t affect the electronic devices very much if at all. Just

7
DIGITAL FORENSICS
to be clear: pure water is distilled water. However, in everyday life, pure water will become
contaminated very quickly. The key to gross circuit damage is related to electrolysis. If the
power to the unit is off when it is submerged then this effect is not present except for battery
powered circuits which are intended to be always powered. For instance the idea of battery
powered keep alive circuits is common on GPS receivers to store the Ephemeris data. Where
these copper traces are exposed and powered they will electrolyze, copper will disappear
depending on Voltage. Also, in the case of modern PC boards with microbial (conductive holes
between layers) where the mediums were not tented in manufacturing, microbial may electrolyze
depending on Voltage. Tenting is an option when designing PC artwork where the mediums have
the protective solder mask printed over the medium. For people dealing with submerged
electronics the recommendation is to dump the water from submersion and get it into clean
(potable) water immediately. This may require opening the covers in order to dump out silt and
other contaminants. A three step wash is better than a dump and refill. Equipment that has been
allowed to dry with silt and other contaminants may have many additional problems besides
electrolysis. Recovering electronics that have been submerged is an art. Experience with the
same type of device from previous submersion is helpful. The devices can then be recovered to a
certain extent.
5. Then look at cases where drives have been recovered from water. What have other
people done. What success or otherwise have they had. What will you do that is different?
There are various methods of recovering a hard disk from water. If the hard drive is
damaged by water, it’s important to take care of the issue as quickly as possible to have the best
chance of recovering the data from the hard drive. Assumptions that leaving the hard drive alone
for a few days won’t hurt the data in the hard drive should not be done. Hard drives are delicate,

8
DIGITAL FORENSICS
and can be easily damaged from mild bumps or drops. So trying to switch and power on the
computer system, laptop, storage box, external USB HDD (Hard Disk Drive) or the Server etc.
should not be done. Drying methods that involve heat can potentially damage the platters of the
hard drive, making data recovery nearly impossible (Albanna & Riadi, 2017). All water, whether
it’s water from a flood or storm, or water that people drink has particles and minerals in it that
will stick to the platters of the hard drive if the hard drive dries out. That makes data recovery
even more difficult than if the platters were already wet. Attempt to rinse or clean the hard drive
if it is dirty, as doing so without the proper tools or solutions almost always makes recovering
stored data from the hard drive more difficult. Attempt to remove the cover from the hard drive
(Tabone & Sprangler, 2017). The idea of opening the device; this can expose it to airborne
contaminates making hdd recovery impossible. Trust trained professionals can open the hard
disk in controlled Class 100 Clean room environment, used specially in case of severely
damaged hard disks. The water regardless of the source contains particles that can damage the
platter making the situation critical. People attempt to keep the devices under sun or use blow
dryer which further aggravates the chances of data recovery. The first area the drive tries to read
on spin-up is the hard drive operating system (HDD O/S or drive firmware). The bulk of this
operating system is unique in-factory calibrations and unique defect lists and unique zone tables
that varies wildly from drive to drive and is required to make sense of the binary that gets pulled
off the platters, or pulling data off the platters in the first place. So when people spin these up
with dirt/moisture inside a lot of times this critical area gets wrecked and that can cause outright
failure to recover data. The suggestion is to keep the media device (Hard Disk) wrapped in a
towel or any air tight pack and opt for professional data recovery services. Doing so exposes the
extremely sensitive platters of the hard drive to airborne particles, which makes recovering data

9
DIGITAL FORENSICS
from the hard drive nearly impossible. Wrapping the hard drive in paper towel and put it in an air
tight bag while removing as much air from the bag as possible is a very good option for the
recovery of the hard drive. No modern HDD platter is 100% "clean". Apart from error correction
information that the OS includes in the data it stores, the firmware on the HDD controller board
writes additional error correction information to counteract tiny areas of the platter that will
always "fail". Because the controller board corrects these errors before handing information back
to the OS, this low-level error correction is completely transparent. Data recovery specialists
remove the cover of a hard drive only in an enclosed environment known as a Class 100 Clean
room, which filters out all airborne particles that may be harmful to the platters of a hard drive.
Additionally it should be noted that the hard drives can be dried using the provided options and
used by the user after the drive is fully dried. However this, does not ensure that data in the drive
will be fully recovered. In general the hard drive is destroyed in situations like this. If the drive is
a SSD, data recovery may be difficult. Differ from files deletion on common hard drive, when
deleting a file, the content will be erased immediately under the TRIM command.
References
Abdi, A. N. E. (2017). MP4-Karver: carving of corrupted MP4 videos using ASMD repairing
technique (Doctoral dissertation, Universiti Tun Hussein Onn Malaysia).
Abeykoon, I., & Feng, X. (2017, June). A Forensic Investigation of the Robot Operating System.
In Internet of Things (iThings) and IEEE Green Computing and Communications
(GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE
Smart Data (SmartData), 2017 IEEE International Conference on(pp. 851-857). IEEE.

10
DIGITAL FORENSICS
Albanna, F., & Riadi, I. (2017). Forensic Analysis of Frozen Hard Drive Using Static Forensics
Method. International Journal of Computer Science and Information Security, 15(1), 173.
Bos, J. V. D. (2017, September). Sustainable automated data recovery: a research roadmap.
In Proceedings of the 1st ACM SIGSOFT International Workshop on Software
Engineering and Digital Forensics (pp. 6-9). ACM.
Boss, G. J., Drissi, Y., Rick, A. H. I., & Li, C. S. (2017). U.S. Patent No. 9,621,586. Washington,
DC: U.S. Patent and Trademark Office.
Dewald, A., & Seufert, S. (2017). AFEIC: Advanced forensic Ext4 inode carving. Digital
Investigation, 20, S83-S91.
Freiling, F., Glanzmann, T., & Reiser, H. P. (2017). Characterizing loss of digital evidence due
to abstraction layers. Digital Investigation, 20, S107-S115.
Jin, C. (2017, December). Brief Talk about Lithium-ion Batteries’ Safety and Influencing
Factors. In IOP Conference Series: Materials Science and Engineering (Vol. 274, No. 1,
p. 012152). IOP Publishing.
Johnson, W., Ahmed, I., Roussev, V., & Lee, C. B. (2017, August). Peer Instruction for Digital
Forensics. In 2017 {USENIX} Workshop on Advances in Security Education ({ASE} 17).
USENIX} Association}.
Lee, C. E., Zheng, L., Zhang, Y., & Thing, V. L. (2017, February). Low-Dimensional Bigram
Analysis for Mobile Data Fragment Classification. In SG-CRC (pp. 129-142).
Nemetz, S., Schmitt, S., & Freiling, F. (2018). A standardized corpus for SQLite database
forensics. Digital Investigation, 24, S121-S130.

11
DIGITAL FORENSICS
Prem, T., Selwin, V. P., & Mohan, A. K. (2017, April). Disk memory forensics: Analysis of
memory forensics frameworks flow. In Power and Advanced Computing Technologies
(i-PACT), 2017 Innovations in (pp. 1-7). IEEE.
Pyo, Y., Lee, C., & Lee, H. (2017, August). Visual analysis of corrupted video data in video
event data recorders. In Dependable and Secure Computing, 2017 IEEE Conference
on (pp. 453-458). IEEE.
Robins, N., Williams, P. A., & Sansurooah, K. (2017). An investigation into remnant data on
USB storage devices sold in Australia creating alarming concerns. International Journal
of Computers and Applications, 39(2), 79-90.
Schatz, B. (2017). U.S. Patent Application No. 15/328,452.
Shu, J., Zhang, Y., Li, J., Li, B., & Gu, D. (2017). Why data deletion fails? A study on deletion
flaws and data remanence in Android systems. ACM Transactions on Embedded
Computing Systems (TECS), 16(2), 61.
Sprecher, B., Kleijn, R., & Kramer, G. J. (2014). Recycling potential of neodymium: the case of
computer hard disk drives. Environmental science & technology, 48(16), 9506-9513.
Tabone, R., & Spangler, R. R. (2017). U.S. Patent No. 9,836,606. Washington, DC: U.S. Patent
and Trademark Office.
Tomer, S., Apurva, A., Ranakoti, P., Yadav, S., & Roy, N. R. (2017, October). Data recovery in
Forensics. In Computing and Communication Technologies for Smart Nation (IC3TSN),
2017 International Conference on (pp. 188-192). IEEE.

12
DIGITAL FORENSICS
Yang, Y., Xu, Z., Liu, L., & Sun, G. (2017). A security carving approach for AVI video based on
frame size and index. Multimedia Tools and Applications, 76(3), 3293-3312.