Chapter 9 External Hardware Interfaces

Chapter 9 External Hardware Interfaces
Graymark DFnDR Trainer 9-1

INTRODUCTION
Many devices are available for external connection to computers. These devices
include:
• Hard Drives
• Optical Drives
• Tape Drives
• Memory Cards
• USB Drives
• Printers
• Scanners
• FAX Machines
To enable communication between an external device and a computer, there must
be two key elements:
• Hardware interface
• Software interface
There are several popular hardware interfaces. Each hardware interface typically
has a corresponding software interface. The hardware interfaces include:
• USB (Universal Serial Bus)
• FireWire (IEEE 1394)
• Parallel Port
Chapter 9
External Hardware Interfaces
KNOWLEDGE OBJECTIVES
After you successfully complete this chapter you will have the knowledge to:
1. List the different type of external hardware interfaces
2. Explain the USB standards
3. Describe the FireWire standards
4. Identify parallel ports and cable connectors
5. Distinguish a SATA port from an eSATA port
6. Recognize an infrared port
9-2 Graymark DFnDR Trainer
• eSATA (External SATA)
• Infrared
UNIVERSAL SERIAL BUS
Universal Serial Bus (USB) is a serial communication hardware interface. USB
devices are connected through various devices, including:
• USB hub
• Keyboard hub
• Monitor hub
• Computer motherboard
A USB system needs a host, in either the computer or USB hub. According to the
USB rules, only one host is allowed on the USB bus. USB is designed to support
low-speed peripheral devices such as:
• Keyboards
• Mice
• Printers
• Scanners
• Modems
• Network Interface Controllers (NICs)
• Digital Cameras
• Video Monitors
• PDAs
• Joysticks
• Camcorders
ICON The icon used to identify USB connectors and devices is shown in Figure 9-1.
Figure 9-1. USB icon
USB 1.1 The USB 1.1 standard was developed by Compaq, DEC, IBM, Intel, Microsoft,
NEC, and Northern Telecom. The primary goal was to provide a seamless way for
computer users to connect devices. The goal was to develop a true plug-and-play
system without requiring a computer user to upgrade internal components of the
computer system.
The USB bus supports digital video standards MPEG-1 and MPEG-2. USB
transfers data at a rate of 12 Megabits per second for the USB 1.1 standard. USB
1.1 can support up to 127 USB devices. Device speed will vary from 1.5 MB/sec
to 12 MB/sec. The lower rate is intended for input devices such as mice and
keyboards. The high-end rate of 12 MB/sec is intended for storage devices, as
well as video and audio devices.
The USB 1.1 standard allows hot pluggable or hot swapping. This means that a
USB device can be installed or detached without powering OFF the computer.
Plug-and-play is supported through appropriate USB device drivers via the
operating system or manufacturer.
The USB bus is self-powered or powered through a USB hub supplying between
100 mA and 500 mA of current. A self-powered USB bus is the type found in a
computer system.
USB 2.0 The USB 2.0 standard transfers data at rates of 480 MB/sec. USB 2.0 is also
designed to be downward compatible with USB 1.1 devices.
USB HUB A USB hub allows several USB devices to be connected to one USB computer
port. A USB hub has peripheral ports to which external devices can be connected
The number of peripheral ports on a hub can vary from two to 16. A 4-port USB
hub is shown in Figure 9-2.
Figure 9-2. 4-Port USB hub
DATA
TRANSMISSION
Data flowing from the device to the host is called upstreaming. Data flowing from
the host to the device is called downstreaming. The host, whether it is a USB hub,
motherboard USB host, or USB expansion card, is connected electrically through
wires.
CABLES &
CONNECTORS
A USB 1.1 standard cable is 20 AWG, shielded, twisted-pair (STP), four
conductors (2 pairs). The maximum cable length between devices cannot exceed 5
meters (16 feet).
There are two USB connector types:
• Type A
• Type B
There are also three sizes of USB connectors:
• Standard
• Mini
• Micro
Figure 9-3 shows the various types and sizes of USB connectors. You can easily
see the relative sizes of the connectors. There will be close ups of the connectors
later in this section.
Figure 9-3. USB cable connector types & sizes
TYPE A
The Type A connector is used on computers or other hosts. This connector is
thinner and wider than Type B; it is more rectangular than Type B. A Type A port
and cable connector are shown in Figure 9-4 and Figure 9-5.
Figure 9-4. USB Type A port
Figure 9-5. USB Type A cable connector
TYPE B
The Type B connector is used on peripheral devices such as printers. This
connector is thicker and narrower than Type A; it is more square than Type A. A
Type B port and cable connector are shown in Figure 9-6 and Figure 9-7.
Figure 9-6. USB Type B port
Figure 9-7. USB Type B cable connector
Some manufacturers alternatively use the terms Series A and Series B.
Upstream connectors are Type B, and downstream connectors are Type A.
Microsoft specifies that computers sold with Windows must have at least four
externally accessible USB ports.
MINI USB CONNECTORS
As the need for smaller connectors emerged, a Mini USB connector was
developed. A Mini USB cable connector is shown in Figure 9-8.
Figure 9-8. Mini USB cable connector
MICRO USB CONNECTORS
Even smaller on-the-go demanded USB connectors that were smaller than the
Mini USB. The Micro USB connector, shown in Figure 9-9, is smaller than the
Mini USB connector.
Figure 9-9. Micro USB cable connector
OPERATING
SYSTEM SUPPORT
Not all operating systems will fully support USB. In other words, all operating
systems are not fully compatible with USB. The operating system, motherboard
BIOS, and motherboard chip set must all support USB for the best performance.
Windows 95 OSR 2.1 offered limited support for USB. Windows 98, Windows
XP, Windows 2000 and MAC OS 8.1 offer expanded support for USB and USB
devices.
INTRODUCTION In this exercise, you will examine USB connectors and cables.
INVESTIGATION
COMPUTER SETUP
None.
PROCEDURE 1. Retrieve the following items:
• Notebook Computer
• eSATA Forensic Bridge
• USB Cable (part of eSATA Forensic Bridge Set)
• USB Thumb Drive
2. Examine your USB Thumb Drive. Identify the USB Connector.
It has a Type A USB Connector.
3. Examine your Notebook Computer. Identify the USB Connectors.
It will probably have four Type A USB Connectors.
4. Examine the USB Cable from your eSATA Forensic Bridge. Identify the
USB Connectors.
It has a Type A USB Connector on one end and a Mini USB Connector on
the other end.
EXERCISE 9.1 - EXAMINE USB DEVICES, CABLES & PORTS
SKILL OBJECTIVES
After you successfully complete this exercise you will have the skills to:
1. Identify the different USB ports and cable connectors
5. Examine your eSATA Forensic Bridge. Identify the USB Connector.
It has a Mini USB Connector.
INSTRUCTOR’S
EVALUATION
Your instructor will evaluate and grade your work in this exercise.
COMMENTS
INITIALS: __________ DATE: __________
FIREWIRE (IEEE 1394)
FireWire is a high-speed serial bus interface that is designed to transfer large
amounts of data. Typical uses include:
• Graphic images
• Video files
• Audio files
• Live video & audio
ICON The icon used to identify FireWire / IEEE 1394 connectors and devices is shown
in Figure 9-10.
Figure 9-10. FireWire / IEEE 1394 icon
Originally designed by Apple Computer Corporation and Texas Instruments, the
bus became the IEEE 1394 standard. Current brand names for IEEE 1392 are:
• FireWire (Apple)
• i.LINK (Sony)
RATING
Poor Good Excellent
ITEM 1 2 3 4 5
Followed Instructions
Completed Work
Thorough & Clear
Accurate GRADE
TOTAL + + + + =
• Lynx (Texas Instruments)
The IEEE 1394 standard and FireWire support Plug and Play and hot plug.
FIREWIRE 400
(IEEE 1394A)
The original IEEE 1394a specification provides for data transfer rates of 100, 200,
and 400 MB/sec. There are two types of FireWire 400 connectors:
• 4-Pin
• 6-Pin
The 4-pin and 6-pin connectors are shown in Figure 9-11 and Figure 9-12.
Figure 9-11. 4-Pin FireWire 400 cable connector
FIREWIRE 800
(IEEE 1394B)
The IEEE 1394b specification provides for data transfers of 800, 1600, and 3200
MB/sec. FireWire 800 uses a 9-pin connector, shown in Figure 9-13.
DATA
TRANSMISSION
Data transmitted over the wire is isochronous. This allows real time transfer of
video data, which is data intensive.
CABLES &
CONNECTORS
Up to 62 devices can be placed on the bus. The maximum cable length between
devices is 4.5 meters.
OPERATING
SYSTEM SUPPORT
Not all operating systems fully support IEEE 1394. Just as with USB, the
operating system, motherboard BIOS, and motherboard chip set must support
IEEE 1394 for the best performance.
Windows 95 OSR 2.1 offered limited support for USB. Windows 98, Windows
2000, and MAC OS 8.1 offer support for IEEE 1394. Be sure to check with the
manufacturer of the IEEE 1394 device and the operating system to determine if
support is available.
INTRODUCTION In this exercise, you will examine FireWire ports and cables.
INVESTIGATION
COMPUTER SETUP
None.
• Notebook Computer
• FireWire Cable (part of eSATA Forensic Bridge Set)
2. Examine your Notebook Computer. Identify the FireWire Connector.
It will probably have one 4-pin FireWire Connector.
3. Examine the FireWire Cable from your eSATA Forensic Bridge. Identify
the FireWire Connectors.
It has a 9-Pin FireWire 800 Connector on each end.
4. Examine your eSATA Forensic Bridge. Identify the FireWire Connectors.
It has one 6-Pin FireWire 400 Connector and two FireWire 800
Connectors.
EXERCISE 9.2 - EXAMINE FIREWIRE DEVICES, CABLES &
PORTS
SKILL OBJECTIVES
1. Identify the different FireWire ports and cable connectors
INSTRUCTOR’S
EVALUATION
COMMENTS
INITIALS: __________ DATE: __________
PARALLEL PORT
As is the case with most technology, standards evolve and improve over time. The
parallel port interface is no exception. There are two parallel port standards:
• Standard
• Enhanced Parallel Port (EPP)
STANDARD The standard parallel port data transfer rate is approximately 150 KB/sec. The
interface provides unidirectional communication. This means that data could only
be sent from the computer to the printer. Data could not be sent from the printer to
the computer. The cable length cannot exceed 12 feet.
ENHANCED
PARALLEL PORT
(EPP)
The IEEE 1284 standard is also known as Enhanced Parallel Port (EPP). This
standard provides high-speed bidirectional communication. The EPP
enhancement was designed to transfer data at a rate of 600 KB/sec through 1.5
MB/sec. The maximum cable length is 32 feet.
ICON The icon used to identify parallel port connectors and devices is shown in
Figure 9-14.
Figure 9-14. Parallel port icon
RATING
Poor Good Excellent
ITEM 1 2 3 4 5
Completed Work
Thorough & Clear
Accurate GRADE
TOTAL + + + + =
Until printer manufacturers began providing USB interfaces on their products, the
most common printer interface was the parallel port. The most common device
connected to the parallel port was a printer, therefore, the parallel port icon is a
printer.
Even though the parallel port icon looks like a printer, the port can be used for any
parallel device. The most popular devices with a parallel interface include:
• Printers
• Scanners
• FAX machine
CABLES &
CONNECTORS
The parallel interface uses a large number of connections. The minimum number
of wires in a parallel interface cable is 18. A thick cable is used to connect printers
and other parallel devices to a computer.
DB-25 CONNECTOR
The parallel port connector on a computer is a 25-pin female D type connector,
commonly referred to as a DB-25 connector. The female DB-25 computer
connector is shown in Figure 9-15.
Figure 9-15. DB-25 female connector on computer
A parallel cable is used to connect a device with a parallel interface to a computer.
The end that connects to a computer is a male DB-25 connector. This cable
connector is shown in Figure 9-16.
Figure 9-16. DB-25 male cable connector
The other end of a parallel cable will have one of two different connectors:
• DB-25 male
• Centronics
CENTRONICS CONNECTOR
The first printer with a parallel interface was manufactured by Centronics. They
installed a 36-pin connector on the printers. Since Centronics designed the
connector, it was, and still is, referred to as a 36-pin Centronics connector. A
drawing of the 36-pin Centronics cable connector is shown in Figure 9-17.
Figure 9-17. 36-Pin Centronics cable connector
INTRODUCTION In this exercise, you will examine parallel ports and cables.
INVESTIGATION
COMPUTER SETUP
None.
• Parallel Cable from FRED Large Cables Storage Container
2. Examine the Parallel Cable from the FRED Large Cables Storage Container.
Identify the Parallel Connectors.
It has a DB-25 male connector on one end and a 36-pin Centronics
connector on the other end.
3. Examine the back of the Desktop Evidence Computer. Identify the
Parallel Connector.
It has a DB-25 female connector.
EXERCISE 9.3 - EXAMINE PARALLEL CABLES & PORTS
SKILL OBJECTIVES
1. Identify the parallel ports and cable connectors
INSTRUCTOR’S
EVALUATION
COMMENTS
INITIALS: __________ DATE: __________
eSATA
In 2004, a modified version of the SATA hard drive interface was developed for
use as an external hardware interface.
ICON There is no standard icon used to identify eSATA connectors. There is, however,
an icon that is often printed on eSATA devices. This printed icon is shown in
Figure 9-18.
Figure 9-18. eSATA icon
CABLES &
CONNECTORS
The SATA connector was modified for the eSATA external hardware interface. It
has several features that the SATA connector does not have, including:
• More rugged
• Resists accidental unplugging
• No L-shaped key
• Improved electro-static discharge protection
An eSATA cable connector is shown in Figure 9-19. Two eSATA connectors on a
computer are shown in Figure 9-20. A connector that is mounted to a piece of
equipment is usually referred to as a chassis connector.
RATING
Poor Good Excellent
ITEM 1 2 3 4 5
Completed Work
Thorough & Clear
Accurate GRADE
TOTAL + + + + =
Figure 9-19. eSATA cable connector
Figure 9-20. eSATA chassis connectors
The maximum eSATA cable length is 2 meters (6.6 ft).
INTRODUCTION In this exercise, you will examine SATA and eSATA ports and cables.
INVESTIGATION
COMPUTER SETUP
1. If Windows is not already running, boot to Windows.
2. Be sure that you are logged on as the User.
• SATA Mobile Drive Rack
EXERCISE 9.4 - IDENTIFY SATA & ESATA CABLES &
PORTS
SKILL OBJECTIVES
1. Identify SATA and eSATA ports and cable connectors
• SATA Cable (part of eSATA Forensic Bridge Set)
• eSATA Cable (part of eSATA Forensic Bridge Set)
2. Examine the SATA Mobile Drive Rack. Identify the SATA Connector.
It has one SATA Connector on the back side.
3. Examine the SATA Cable from your eSATA Forensic Bridge. Identify the
SATA Connectors.
It has SATA Connectors on both ends.
4. Examine your eSATA Forensic Bridge. Identify the eSATA Connector.
It has one eSATA Connector.
5. Examine the eSATA Cable from your eSATA Forensic Bridge. Identify
the eSATA Connectors.
6. It has eSATA Connectors on both ends.
INSTRUCTOR’S
EVALUATION
COMMENTS
INITIALS: __________ DATE: __________
INFRARED
Consumer devices have used the infrared interface for many years. Devices using
the infrared interface include remote controls for TVs, VCRs, DVD players and
audio equipment
RATING
Poor Good Excellent
ITEM 1 2 3 4 5
Completed Work
Thorough & Clear
Accurate GRADE
TOTAL + + + + =
Infrared interfaces use as a very narrow beam of invisible light. The interface
communication is established by having two infrared devices pointed toward each
other without anything in between. This is referred to as line-of-sight alignment.
The distance between infrared devices can range up to 3 meters depending on the
model.
Although less popular today, some computers and peripheral devices were
manufactured with an infrared port. These peripheral devices include:
• Printers
• Modems
• Network interface controllers (NICs)
• PDAs
An external infrared port is shown in Figure 9-21. This external port is connected
to a computer via a USB cable.
Figure 9-21. External infrared port
ICON The icon used to identify eSATA connectors and devices is shown in Figure 9-22
Figure 9-22. Infrared port icon
SUMMARY
After successfully completing this chapter, you have the knowledge to:
1. List the different type of external hardware interfaces
2. Explain the USB standards
3. Describe the FireWire standards
4. Identify parallel ports and cable connectors
5. Distinguish a SATA port from an eSATA port
6. Recognize an infrared port
This completes Chapter 9. Proceed to the next chapter.
NOTES
Chapter 10 Hard Disk Drives
INTRODUCTION
Hard disk drives are the primary memory storage device used in computers. A
wide variety of hard drives has been used in computers. Each type of hard drive
requires different cables and electronic interface. A well-equipped digital
forensics laboratory will be able to analyze any type of hard drive.
More importantly, the digital forensics examiner must have knowledge of all types
of hard drives and a thorough understanding of how each drive operates. This
chapter provides a thorough discussion of hard drives.
In this chapter, the following aspects of hard disk drives will be covered:
• Specifications
• Electro-Mechanical Components
• Hard Drive Types
• Hard Drive Operation
• Encoding Schemes
SPECIFICATIONS
General hard drive specifications include:
• Capacity
• Physical Size
• Throughput Rate
Chapter 10
Hard Disk Drives
KNOWLEDGE OBJECTIVES
After you successfully complete this chapter you will have the knowledge to:
1. List hard disk drive specifications
2. Describe the electro-mechanical components in a hard drive
3. Identify the different types of hard drive interfaces
4. Explain how a hard drive operates
5. Understand the purpose of a hard drive jumper
6. List the various encoding schemes used in hard drives
• Access Time
• Mean Time Before Failure
• Mean Time Data Loss
• Latency Time
• Interleave
• Defect Map
CAPACITY Capacity is the total formatted storage ability of the drive. There are three levels
of size used to expressed the capacity:
• Megabytes (MB) - millions of Bytes
• Gigabytes (GB) - billions of bytes
• Terabytes (TB) - trillions of bytes
PHYSICAL SIZE Hard drives are manufactured in a range of sizes. As technology advances are
made, the physical size of hard drives is reduced and the memory storage capacity
increases. The first hard drives were physically very large and stored a relatively
small amount of data. Today’s hard drives are much smaller and have a
significantly large capacity.
The physical size of a hard drive is given in inches. The dimension refers to the
width of the drive. The most common hard drive sizes today are:
• 3.5”
• 2.5”
• 1.8”
Figure 10-1 shows the relative sizes of several hard drive sizes. Two types of the
3.5” and 2.5” drives are shown.
Figure 10-1. Different hard drive sizes
THROUGHPUT
RATE
Throughput is the rate at which data is transferred from the read/write heads to the
system bus. Throughput is measured in Kilobytes per second.
ACCESS TIME Access Time (also referred to as seek time) is the average time the read/write
heads take to move over a specified cylinder and sector. Access time is measured
in either milliseconds or microseconds.
MEAN TIME
BEFORE FAILURE
Mean Time Before Failure (MTBF) is the average time the manufacturer has
determined between consistent failures of a drive component. MTBF is measured
in thousands of hours.
MEAN TIME DATA
LOSS
Mean Time Data Loss (MTDL) is the average time it will take for a loss in data to
occur.
LATENCY TIME Latency Time is the amount of time it takes for the correct cylinder to come
directly under the read/write heads.
INTERLEAVE Interleave is a ratio (5:1, 3:1, 1:1) that indicates how many revolutions the platters
will rotate under the read/write heads before the next sector is found.
DEFECT MAP Defect Map is a table written into the BIOS of the hard drive that contains specific
areas of the platters that have physical damage.
ELECTRO-MECHANICAL COMPONENTS
All hard disk drives have the same electro-mechanical components. The design of
each component varies by hard drive manufacturer and model.
The term hard disk was originally used to distinguish it from flexible or floppy
disks. As the name implies, a disk that is hard is used as the memory storage
media in a hard disk drive.
The hard disk drive components consist of:
• Electronic circuit board
• Mechanical assembly
The electronic circuit board is mounted to the hard drive. The electronic circuit
board contains:
• Microprocessor
• ROM
• Servo control circuits
• Read/write bus
• Data cable connector
• DC power connector
• Drive select header
As shown in Figure 10-2, the mechanical assembly consists of:
• Disks or platters
• Spindle
• Head arms
• Read/write heads
• Head actuator
Figure 10-2. Typical hard drive components
The hard disk drive is sealed when manufactured. The disks/platters spin at a rate
of 5400 rpm or more. The read/write heads do not touch the platters; they “fly”
over the platters at a height of only 2 to 3 micro inches. (A human hair is 3000
micro inches thick) If the drive is opened, any dirt or dust will damage the heads
and also will cause physical damage to the platters.
PLATTER Depending on the hard disk drive size, the drive can have one or more platters
encased in the housing. The platter consists of an aluminum disk coated with a
highly polished magnetic media.
FORMATTING
A new hard drive is not formatted. Prior to installing an operating system, a
partition must be created using the FDISK utility. It must then have a high level
formatting using the DOS FORMAT command.
After formatting, the platters are divided into tracks and sectors, as shown in
Figure 10-3. A sector is the smallest addressable area on the hard disk drive. A
sector is usually 512 bytes.
Figure 10-3. Disk & sector layout
HARD DRIVE CYLINDER
A track on a hard disk drive is referred to as a cylinder. The cylinder is comprised
of all the tracks located in the same physical area on all the platters. The read/
write heads read from and write to these areas at the same time.
SKEWING
As the read/write heads move to an adjacent cylinder to continue a read or write
operation, it often misses the proper track. The heads must wait until the data track
they are seeking returns on the next revolution. Although the wait time may seem
miniscule, the time accumulated over thousands of revolutions would
significantly slow the read/write process if engineers had not built in
compensating designs.
Track Skewing
Track skewing is a method in which the read/write heads read or write data to
multiple platters at the correct timing interval. The platters are designed so when
data located in track 1, sector 8 on platter 1 has been read, data located in track 1,
sector 8 on platter 2 is in position to be read. This is illustrated in Figure 10-4.
Figure 10-4. Track skewing
Cylinder Skewing
Cylinder skewing is utilized to change from cylinder to cylinder without waiting
for the platter to make one revolution. When cylinder 1, sector 8 of platter 1 has
been read, cylinder 2, sector 1 is ready to be read, as shown in Figure 10-5.
Figure 10-5. Cylinder skewing
Both track and cylinder skewing are functions controlled by the ROM. Current
hard disk drives are considered high-density drives. The magnetic media that is
distributed on the aluminum platter is of very high coercivity. This allows more
tracks, sectors, and larger allocation units. More data, therefore, can be written to
the drive.
The hard disk drive uses a method of recording called zone bit recording. This
method allows more sectors to be written to the outer most cylinders with a
smaller number of sectors written to the inner most cylinders. The sectors (pie
shaped wedges) become smaller nearer the center of the platter.
HARD DRIVE TYPES
There are several types of hard drives. They are categorized by the type of
hardware interface. The most common types are:
• MFM
• RLL
• ESDI
• IDE
• EIDE
• SCSI
• SATA
• SSD
DRIVE
INTERFACES
Each type of hard drive requires a different drive interface. The drive interface is
the electronic circuitry and connectors that interface the hard drive to the
computer. The following components comprise of the drive interface:
• Controller Electronics
• Encoder Chip
• ROM
• Buffers
• Cache Buffer
• Power Connector
• Data Connector
MFM The oldest type of personal computer hard drive is Modified Frequency
Modulation (MFM). The disk drive control electronics is separate from the hard
drive. A controller input/output (I/O) board is used to connect the hard drive to the
computer. MFM drives are not commonly used today.
RLL Run Length Limited (RLL) is the second oldest personal computer hard drive.
Like the MFM, the disk drive control electronics is separate from the hard drive.
A controller input/output (I/O) board is used to connect the hard drive to the
computer.
ESDI The enhanced small disk interface (ESDI) protocol provided a small improvement
over RLL. The ESDI is the type of drive used in the IBM PS/2 series of personal
computers. It is not in common use today.
IDE / ATA As technology advanced, engineers designed the disk drive electronics into the
hard drive itself. Originally, this was called Integrated Drive Electronics (IDE).
Later, it was renamed to Advanced Technology Attachment (ATA). Both terms
are used interchangeably today.
IDE drives are available in a variety of sizes. A typical 3.5” IDE hard disk drive is
shown in Figure 10-6.
Figure 10-6. Typical 3.5” IDE hard disk drive
CABLES & CONNECTORS
IDE was a major change in the drive electronics. The electronic interface circuitry
was integrated into the hard drive. The IDE drive has two connectors and a
header:
• Power Connector, 4-Pin
• Data Connector, 40-Pin
• Drive Select Header
POWER
The power connector is a 4-pin connector. This connector is also referred to as a
Molex connector. Molex is the connector manufacturer.
The DC power connector supplies power to the hard disk drive. DC voltage used
by the hard disk drive is 12 VDC, 5 VDC and common.
Refer to Figure 10-6 to identify the male connector used on the hard drive. The
power connector on the power supply cable is a female connector, as shown in
Figure 10-7.
Figure 10-7. 4-Pin connector on power supply cable
DATA
IDE / ATA hard drives incorporate a parallel data connection. This parallel
configuration requires a 40-pin data connector. A single 40-pin cable connects the
drive to an IDE controller card or the motherboard if it has an onboard IDE
controller. Integrating the electronics directly to the drive enhances the drive’s
performance.
Refer to Figure 10-6 to identify the male data connector used on the hard drive.
Figure 10-8 shows an IDE data cable.
Figure 10-8. IDE data cable
DRIVE SELECT HEADER
Refer to Figure 10-6 to identify the male drive select header on the hard drive.
This header is used to select one of several operational functions:
• Master - configures the drive as the primary boot drive
• Slave - used if a second drive is connected to the same IDE cable
• Cable Select - allows the BIOS to determine if the drive is the primary boot drive
• Slave Present - used if the drive will be used as a slave drive when the primary drive
is set for Cable select
HEADERS & JUMPERS
Hard drives, motherboards and many other computer devices may have several
open-frame pin connectors called headers. Each header is used for one of two
different functions:
• Connect other computer components to the motherboard
• Serve as a switch
Headers are available in different sizes, such as 2-pin, 3-pin, 4-pin, etc. Typical 2-
pin and 3-pin headers are shown in Figure 10-9.
Figure 10-9. Typical 2-pin & 3-pin headers
Headers Used as Connectors
Headers that are used to connect components together function the same as other
electrical connectors. A wire or cable to be connected to a motherboard or other
component will have a plug on the end of the wire or cable. The plug will be
mated with the motherboard or other component to connect the two components.
Headers Used as Switches
Headers that function as switches use a special connector plug called a shorting
jumper or jumper. Figure 10-9 illustrates a 2-pin jumper. The jumper can connect
two adjacent header pins together.
Together, a header and jumper operate like a switch to select different modes of
operation. Figure 10-10 illustrates a jumper used to select a function by
connecting pins 1 and 2 together.
Figure 10-10. Header and jumper used as a switch
If a jumper is placed on two adjacent header pins, the switch is closed. If the same
two header pins do not have a jumper, the switch is open. Jumpers are removable
and reusable, and can be used on different components.
As shown in Figure 10-11, jumpers are comprised of two pieces:
• Plastic body
• Shorting strip
Figure 10-11. Jumper construction & installation
Figure 10-11 also shows how to use long nose pliers to install and remove a
jumper from a header.
When a jumper is removed from a header, the shorting strip may remain attached
to the header; with only the plastic body removed. If this happens, the header pins
remain connected or closed. After you remove a jumper, always check to make
sure the shorting strip is inside the plastic body.
If the shorting strip is not in the plastic body, it is probably still on the header.
Carefully remove the shorting strip with a small pair of pliers. The shorting strip
can then be reinserted into the plastic body.
IDE BUS VERSIONS
The IDE interface is available in several different configurations:
• XT IDE (8-bit)
• AT Attachment (ATA)
• IDE (16-bit)
• MCA IDE (16 bit Micro-Channel)
EXTENDED TECHNOLOGY (XT)
The XT has an 8-bit bus that uses a 40-pin interface cable.
ADVANCED TECHNOLOGY ATTACHMENT (ATA)
The ATA uses a 40-pin interface cable.
INTEGRATED DRIVE ELECTRONICS (IDE)
The standard IDE has a 16-bit bus.
MICRO-CHANNEL ARCHITECTURE (MCA)
The MCA has a 16-bit architecture and uses a 72-pin interface cable.
EIDE An improved version of IDE is the Enhanced Integrated Drive Electronics (EIDE)
drive. Unlike IDE drives, the EIDE drive protocol doesn’t require much CPU
processing time. EIDE hard drives must work with an EIDE hard drive controller
for best performance.
EIDE INTERFACE
ATA-2 or EIDE (Enhanced IDE) is an extension of the original ATA that includes
features such as PIO (programmed I/O) and DMA modes. These are basically
performance enhancing features.
The main benefits of ATA-2 are twofold:
• Increased capacity due to an advance in BIOS to work with drives larger than 504
MB
• Faster data transfer rates
ATAPI ATA Packet Interface (ATAPI) is one of most common standards found on IDE/
EIDE drives, as well as CD-ROM and internal ZIP drives. ATAPI is interface
hardware that is located on the drive’s electronic circuit board. With an ATAPI
interface in place, the drive does not need a software driver.
Windows 9X, Windows NT, Windows 2000, Windows ME, Windows XP and
Linux all support the ATAPI interface. If a drive needs to operate in a DOS
environment, however, then separate software drivers have to be installed.
SATA The original Advanced Technology Attachment (ATA) protocol uses a 40-wire
parallel data interface. The parallel ATA system was modified to create the Serial
Advanced Technology Attachment (SATA) protocol.
Transfer rates for Serial ATA begin at 150MBps. The thinner ATA serial cables
also allow a more efficient airflow inside a computer. Serial ATA cables can be as
long as one meter. A typical SATA drive is shown in Figure 10-12.
Figure 10-12. Typical SATA hard drive
CABLES & CONNECTORS
The SATA system employs a 4-wire serial connection to the computer. SATA data
transfer rates are faster that ATA rates. There are four varieties of SATA
connectors:
• Standard
• Slimline
• Micro
Standard
The Standard SATA cable is used on standard SATA hard drives. The connector
has 22 pins:
• 7 pins for data
• 15 pins for power
A close up of the SATA hard drive connectors is shown in Figure 10-13.
Figure 10-13. SATA drive connectors
Slimline
The Slimline SATA cable is used on Slimline SATA hard drives. The connector
has 13 pins:
• 7 pins for data
Micro
The Micro SATA cable is used on 1.8” SATA hard drives. This connector has 16-
pins:
• 7 pins for data
DATA
SATA drives can be easily distinguished from ATA drives by observing the data
connector or cable. ATA cables are very wide, while SATA cables are very
narrow, as shown in Figure 10-14. The SATA cable is on the left, and the IDE
cable is on the right.
Figure 10-14. SATA & IDE (ATA) data cables
POWER
SATA drives may have one of three different power connectors:
• Standard
• Slimline
• Micro
IDE (ATA) power cable connectors cables have 4 large pins, while SATA power
cable connectors have 15 small pins, as shown in Figure 10-15. The SATA power
cable connector is on the left, and the IDE (ATA) power cable connector is on the
right.
Figure 10-15. SATA & IDE (ATA) power cable connectors
SATA II
SATA II drives have the same interface and other physical characteristics. The
primary difference is that the SATA II has a much faster data transfer rate.
INTRODUCTION In this exercise, you will examine various hard drives to identify characteristics
that differentiate the types of hard drives.
INVESTIGATION
COMPUTER SETUP
1. If Windows is not already running, boot to Windows.
2. Be sure that you are logged on as the User.
PROCEDURE 1. See your instructor for the procedure.
EXERCISE 10.1 - IDENTIFY DIFFERENT TYPES OF HARD
DRIVES
SKILL OBJECTIVES
1. Identify different types of hard drives
NOTE
This is an optional exercise. Your instructor will advise you of the procedure.
INSTRUCTOR’S
EVALUATION
COMMENTS
INITIALS: __________ DATE: __________
IMAGE DRIVE
Your Trainer includes a SATA Hard Drive. You will use this SATA Drive to
capture images from evidence devices. Since it will be used to capture images, it
will be referred to as your Image Drive.
To protect your Image Drive, you will mount it in a mobile hard drive rack. A
mobile hard drive rack is an external hard drive housing. The rack provides
physical and electro-static protection for a hard drive.
Like hard drives, mobile racks are available for different sizes and types of hard
drives. Your Mobile Rack, shown in Figure 10-16, is a 3.5” SATA type to match
your 3.5” SATA Image Drive.
RATING
Poor Good Excellent
ITEM 1 2 3 4 5
Completed Work
Thorough & Clear
Accurate GRADE
TOTAL + + + + =
Figure 10-16. 3.5” SATA Mobile Rack
INTRODUCTION In this exercise, you will mount your SATA Image Drive into the Mobile Rack.
INVESTIGATION
COMPUTER SETUP
None.
• SATA Mobile Rack
• SATA Hard Drive
• Phillips Screwdriver
2. Open the Mobile Rack Latch, as shown in Figure 10-17.
EXERCISE 10.2 - MOUNT SATA IMAGE DRIVE IN MOBILE
RACK
SKILL OBJECTIVES
1. Mount a hard drive in a mobile rack
Figure 10-17. Opening Latch
3. Swing the hinged Access Door open, as shown in Figure 10-18.
Figure 10-18. Swinging Access Door open
4. Slide the Drive Tray out, as shown in Figure 10-19.
If the Drive Tray does not slide out, it may be locked. Insert one of the
Keys that was supplied with your Mobile Drive Rack in the Lock to
unlock the Drive Tray.
Figure 10-19. Sliding the Drive Tray out
5. Pull the Drive Tray completely out of the Rack, as shown in Figure 10-20.
Figure 10-20. Drive Tray out of Rack
6. The Rack has a Metal Cover that must be removed. There is a plastic
Button labeled PUSH next to the OPEN label on the Metal Cover. As
shown in Figure 10-21, while pressing on the PUSH Button, slide the
Metal Cover toward the rear of the Rack.
Figure 10-21. Sliding the Metal Cover off the Rack
7. Remove your SATA Hard Drive from its Carton.
8. Remove the Hard Drive from its Anti-Static Bag. Save the Carton and
Anti-Static Bag.
9. Holding the Hard Drive at an angle, carefully place it in the Drive Tray, as
shown in Figure 10-22.
Figure 10-22. Placing SATA Hard Drive in Drive Tray
10. Check the Rear Panel of the Mobile Rack. The Hard Drive’s Power and
Data Connectors should be visible through the slot in the Rear Panel.
11. Place the Hard Drive flat inside the Drive Tray. It should look like
Figure 10-23.
Figure 10-23. Hard Drive flat inside Drive Tray
12. While holding the Hard Drive flat inside the Drive Tray, turn the
assembly over.
13. Using the four Screws provided with the Mobile Drive Rack, secure the
Hard Drive to the Drive Tray, as shown in Figure 10-24. Do not
overtighten the Screws.
Figure 10-24. Securing Hard Drive to Drive Tray
14. Turn the Drive Tray over.
15. As shown in Figure 10-25, replace the Metal Cover on the Drive Tray. Be
sure it snaps into place.
Figure 10-25. Replacing Metal Cover on Drive Tray
16. Position the Drive Tray in front of the Mobile Drive Rack, as shown in
Figure 10-26.
Figure 10-26. Positioning Drive Tray and Rack
17. Slide the Drive Tray into the Rack.
18. Carefully close the hinged Access Door. As you close the Door, the Drive
Tray will be moved further into the Rack. The Hard Drive Connectors
will be mated with the Mobile Drive Rack Connectors.
19. Close the Latch.
INSTRUCTOR’S
EVALUATION
RATING
Poor Good Excellent
ITEM 1 2 3 4 5
Completed Work
Thorough & Clear
TOTAL + + + + =
COMMENTS
INITIALS: __________ DATE: __________
SCSI The Small Computer System Interface (SCSI) is a high performance disk drive
interface system. SCSI drives require a special I/O controller board. SCSI is
pronounced “skuzzy”. The interface can access up to seven hard disk drives.
SCSI INTERFACE
SCSI is a system level interface. A SCSI device can be a CD drive, hard disk
drive, scanner or other device. The SCSI system requires a host adapter that
interfaces with other devices. SCSI allows for a mix of different SCSI devices. All
of the devices attached to the host adapter are part of the SCSI bus.
A typical computer system can support up to four SCSI buses. Each SCSI bus can
support up to seven devices plus the host adapter for a total of 28 SCSI devices.
THROUGHPUT
The throughput of newer SCSI host adapters can be 160 MB/sec or more and are
capable of supporting up to 15 devices per channel using 32-bit host adapters. The
host adapter can be plugged into an EISA, ISA or PCI expansion slot, or
integrated onto the motherboard.
DATA TRANSFER RATES
The current SCSI standards include:
• Standard SCSI (SCSI-1)
• Fast SCSI or Fast Wide SCSI (SCSI-2)
• Ultra-2 or Wide Ultra-2 SCSI (SCSI-3)
• Ultra 160
Several host adapters support the standards:
• 8-Bit
• 16-Bit
• 32-Bit
CABLES, CONNECTORS & TERMINATORS
Accurate GRADE
RATING
Poor Good Excellent
ITEM 1 2 3 4 5
TOTAL + + + + =
The internal cable that SCSI uses is a flat ribbon cable with either a 50 or 68-pin
interface. SCSI cables are either type A or type P.
• Type A is a 50-pin cable and cannot exceed 6 meters (nearly 20 feet)
• Type P is a 68-pin cable that cannot exceed 3 meters (nearly 10 feet)
External Cables
There are several external SCSI cables available. They have different
combinations of connectors.
Figure 10-27 illustrates a SCSI cable with a 50-pin connector at one end and a 68-
pin connector on the other end. In Figure 10-27, the 50-pin connector is on the left
side, and the 68-pin connector is on the right side.
Figure 10-27. SCSI cable connectors
Terminators
On the SCSI bus the first and last SCSI device on the bus must be terminated. The
host adapter and internal SCSI devices have a built in termination. Depending on
the SCSI device, it may have one of three types of terminating devices: Passive,
Active, and Forced Perfect Termination.
• Passive Termination - A network of resistors (used in Normal SCSI)
• Active Termination - uses voltage regulators to ensure the termination voltage is
constant (used in Fast and Wide SCSI)
•
Forced Perfect Termination (FPT) - A diode clamping circuit is used to ensure any
voltage spikes or signal overloads are eliminated. (FPT termination can be found as
FPT-3, FPT-18, and FPT-27)
• Normal SCSI uses FPT-3 or FPT-18
• Wide SCSI uses FPT-27
Depending on the manufacturer, the terminating resistor can usually be enabled
and disabled using a jumper on the device. When daisy-chaining the SCSI
devices, an internal pass-through SCSI terminator may be used.
Figure 10-28 illustrates an assortment of SCSI terminators and adapters.
Figure 10-28. SCSI terminators & adapters
SCSI TYPES
SCSI is also identified as either single-ended SCSI (normal) or differential SCSI.
Each type can be identified by its own symbol located on the SCSI device. See
Figure 10-29 for the SCSI symbols.
Single-ended and differential SCSI devices cannot be mixed on a single SCSI bus.
Figure 10-29. Single-ended and differential SCSI universal symbols
Single-Ended SCSI
Single-Ended SCSI is so named because for every electrical signal that is
transmitted, a single wire must exist for the signal to travel on.
Differential SCSI
Differential SCSI uses two wires for the signal to travel on. This two-wire
interface makes the Differential SCSI less prone to noise and interference.
CONFIGURING SCSI
Refer to Figure 10-30 for the following discussion. Although SCSI configuration
is a little more complex, SCSI devices have to be configured just as with IDE type
drives. The host adapter card is the first thing to be installed and configured. Each
SCSI device is then set with a unique ID number (1 through 7 or greater per bus)
through jumpers or switches on the device.
The last device on the SCSI bus is terminated. Each device is then added, one by
one, to the SCSI host adapter. If needed, a driver or software is loaded so the
system can recognize and access the device.
Figure 10-30. Typical SCSI hookup diagram
External SCSI devices will have an input and output port. An external terminating
resistor is attached to the output port of the last device in the chain.
SCSI ID
Up to seven SCSI devices plus the host adapter can be attached on a single SCSI
bus. A unique identification number called the SCSI ID must be used to identify
each device. SCSI ID numbers are from 0 through 7.
The host adapter is configured for SCSI ID 7 (highest priority ID). Older adapter
cards required you to set SCSI IDs in sequence from that point (6, 5, 4, etc.)
Newer SCSI adapter cards can use an ID in any sequence as long as the ID does
not conflict with anything else on the SCSI bus. Read the manufacturer’s
information about the exact location of the SCSI ID jumpers.
SCSI RULES
• Both ends of the SCSI bus must be terminated
• Set the device to a unique, non-conflicting, ID number. The host adapter will usually
be set for ID 7 while other devices in the chain are set in descending order (older
cards) or any order (newer cards)
• If you are configuring SCSI hard drives, the drive must be partitioned and formatted
prior to the installation of an operating system
A SCSI drive with a 68-pin data connector is shown in Figure 10-31.
Figure 10-31. Typical SCSI hard drive
SOLID STATE A solid-state drive (SSD) does not have platters or any moving parts. It uses flash
type memory. Some SSDs use SRAM or DRAM instead of flash memory. This
type of solid state drive is usually referred to as a RAM Drive.
An SSD acts like (emulates) a hard drive. This makes it very easy to replace a
hard drive with an solid state drive. Because an SSD has no moving parts, it is
much more rugged than hard drives.
HARD DRIVE OPERATION
There will be occasions when the digital forensics examiner must understands
how a hard drive operates. This can be the case when there is difficulty reading a
hard drive, or when the examiner must testify about a hard drive’s operation.
STANDARD CHS Standard CHS (Cylinder Head Sector) is also called Normal. Standard CHS
limits
the drive to addressing 16 heads and 1,024 cylinders, which would give a
maximum capacity of 504 MB.
EXTENDED CHS Extended CHS is also referred to as Large. When chosen, a translated logical
geometry is used to communicate between the drive and BIOS. In order to display
the logical drive parameters, divide the cylinder count by 2 and multiply the
number of heads by 2. This feature allows the BIOS to recognize a hard drive that
is larger than 504 MB.
LOGICAL BLOCK
ADDRESSING
Logical Block Addressing (LBA) linearly addresses sectors at Cylinder 0, Head 0,
and Sector 1 as LBA 0, then addresses everything, in sequence, to the last physical
cylinder of the disk (the standard SCSI addressing scheme). In LBA mode each
sector stores 512 Bytes of data.
Theoretically, LBA can address hard drive sizes as large as 128 GB. Without a
translated CHS, however, the BIOS will only recognize a drive as large as 8 GB,
which translates to LBA limits of 1,024 cylinders, 256 heads, and 63 sectors per
track. The hard drive must be able to support LBA mode in order to be properly
configured.
DRIVE INTERFACE Hard disk drives can also be characterized by interface type.
On virtually all current computers, the drive interface will be onboard the
motherboard.
ENCODING SCHEMES
Hard disk drives can also be characterized by encoding method.
Encoding is the manner in which data is written to and read from the hard disk
drive. Various types of encoding methods have been used in hard disk drives
including Modified Frequency Modulation (MFM) and Run Length Limited
(RLL).
The data recorded onto the magnetic media is stored as 1s and 0s. Data placed on
the disk by the read/write heads is binary data in an encoded form. The drive
electronics has an Encoder/Decoder Chip (ENDEC) that takes the raw data and
converts it into magnetic pulses during the encode/write operation. During the
read/decode operation, it also converts the flux transitions or polarity reversals
picked up by the read head and converts them back into digital data.
When the digital data is applied to the read/write heads, the head creates a
magnetic field domain on the disk media with specific polarities. When a positive
current is applied to the write heads, the magnetic domains are polarized in one
direction. When a negative current is applied to the heads, the magnetic domains
are polarized in the opposite direction. As the write head is being pulsed, it is
writing data to the platters.
As the head encounters a group of magnetic domains during the read operation, it
senses any changes in the magnetic domain polarity or flux reversals. Two
encoding methods are in use today.
FM ENCODING Although FM encoding is not used today, it did lead to the development of MFM.
With FM encoding, a flux reversal in each bit cell is recorded to indicate logic 1.
No flux reversal is indicated as logic 0. Each bit requires a transition cell. Logic 1
is recorded as a clock flux reversal followed by a data flux reversal. Logic zero is
seen as no clock reversal. Since there are two transition cells, the amount of data
the drive can hold is reduced.
MFM ENCODING Twice the amount of data is written in the same number of flux reversals and
clock speeds are doubled in MFM encoding. Floppy disk drives use MFM
encoding. As explained earlier, early hard drives used FM encoding and were
limited in their capacity.
RLL ENCODING Run Length Limited (RLL) encoding is used on all hard drives today including
SCSI drives. RLL increases the drive capacity by over 50 percent. In RLL, groups
of bits are written or read as a unit, then combined to generate specific patterns of
reversal. Clock and data are combined in these patterns. RLL is defined from two
specifications of this code, which is the minimum number (run length) and the
maximum number (run limit) of transition cells allowed between two flux
transitions. The version of the RLL scheme is written as RLL2, 7. There can be as
few as two and as many as seven transition cells separating two flux transitions.
SUMMARY
After successfully completing this chapter, you have the knowledge to:
1. List hard disk drive specifications
2. Describe the electro-mechanical components in a hard drive
3. Identify the different types of hard drive interfaces
4. Explain how a hard drive operates
5. Understand the purpose of a hard drive jumper
6. List the various encoding schemes used in hard drives
This completes Chapter 10. Proceed to the next chapter.

Chapter 9 External Hardware Interfaces

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Chapter 9 External Hardware Interfaces

Uploaded by

Copyright:

Available Formats

Chapter 9 External Hardware Interfaces

Graymark DFnDR Trainer 9-1

You might also like