1
Q
What are the four layers of digital forensic analysis?
A
- physical media
- volume
- file system
- application and OS
2
Q
HDD Characteristics
A
- Platter
- Spindle
- Head
- IDE Connector
3
Q
Platter
A
- similar to a plate, it is the one that will store the digital data
4
Q
Spindle
A
- used to mount and spin the platter
5
Q
Head
A
- the part that is concerned with reading from or writing on the platter
6
Q
BIOS
A
- Basic Input/Output System
- This is the first system software your computer interacts with after pressing start on your PC/laptop
- It provides the computer with an interface to interact with the hardware found
- Stored on the main board of the computer
7
Q
Booting OS
A
- the BIOS starts the OS by jumping to sector zero of the disk, which holds the MBR
- From the MBR, it locates the partition marked as bootable and executes the machine code to either jump to that partition or load the OS
8
Q
SSD
A
- Sold-stat drives
- no mechanical parts spinning around
- relies on electronic chips to store data
- the most common type of SSD uses flash memory
- non-volatile memory that retains data when the power is lost
9
Q
What happens before drives are used?
A
- they are logically divided into sections called Partitions
10
Q
What are the most common partition tables?
A
- MBR
- GPT
11
Q
MBR
A
- Master Boot Record
- Located at the first sector of the hard disk
- the MBR holds three important pieces of information
- boot code
- partition table
- signature
12
Q
What are Logical Partitions
A
- partitions that are created with an extended partition
13
Q
GPT
A
- GUID Partition Table
- provides both backup and integrity checking
14
Q
What is the layout of GPT
A
- protective MBR
- GPT header
- partition table
- partitions
- backups for both GPT header and Partition table
15
Q
HPA
A
- Hidden Protected Area
- area of the disk that is invisible to the OS
- can be used to store malicious code
