CS3DF > Week 3 - Disk and Filesystem Forensics > Flashcards

Week 3 - Disk and Filesystem Forensics Flashcards

(57 cards)

Study These Flashcards
1
Q

CPU

A

brain of the computer. Does all the calculations and runs instructions from

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Core 1

A

one processing unit inside CPU

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Registers

A

super fast, tiny storage spots inside the CPU. Holds data and instructions CPU is currently working on (fastest memory but only a handful of bytes each)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

L1 Cache

A

very small, extremely fast memory right next to/inside each core. Stores the most frequently used data & instructions so the CPU doesn’t have to wait

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Difference between L1 and L3 Cache

A

larger and slower

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

PCI Express

A

high-speed connection bus standard used to connect motherboard components to peripherals e.g. SSD

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

PCIe SSD

A

solid state drive that plugs into PCIe slot (very fast storage)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

NVME SSD

A

fastest type of PCIe SSD. Uses NVMe protocol to get max speed out of PCIe lanes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

RAM

A

Holds program and data CPU is actively using. Fast but volatile

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Chipset

A

Set of chips on motherboard that manages communication between CPU, RAM, storage, USB ports

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

BIOS

A

Basic firmware stored on chip on motherboard. Boots OS, checks hardware with Power-On-Self-Test (POST).

UEFI used for newer system

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

SATA

A

Older connection for hard drives and SSDs. Slower and cheaper than PCIe/NVMe used in older models

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

USB

A

Universal Serial Bus. Standard port for plugging in peripherals

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Types of Computer Memory with examples

A

Non-volatile – retain data without power
In chip – ROM, EPROM
Disks – HDD, SSD, CD
Volatile – loses data without power
In-processor – Registers
SRAM (cache)
DRAM -RDRAM, EDO RAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the layered design approach for forensic analysis?

A

Start at lowest (most raw) level → higher human-readable layers
Prevents missing/altered/hidden data and defeats anti-forensics tricks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Layered Design Layout

A

Physical storage media analysis
Vol Analysis Mem Analysis
File sys, DB, Swap space analysis
Application/OS analysis

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What happens at Physical Storage Media Analysis of Layered Design?

A

Examine raw physical hardware e.g. HDD, platters, SSD
Goal: acquire bit-for-bit raw image.
Look for: bad sectors, magnetic signals, hidden areas.
Avoid relying on OS interpretation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What happens at Volume Analysis of Layered Design?

A

Treats physical media as logical volumes/partitions.
Examine partition tables (MBR/GPT), unallocated spaces, RAID setups, LVM etc
Goal: map layout, recover deleted partitions, identify file-system areas.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is RAID?

A

Redundant Array of Independent Disks - combines multiple hard drives or SSDs into a single logical unit to improve data performance, storage capacity, and reliability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What happens at File System Analysis of Layered Design?

A

Interprets structure on a volume (e.g. NTFS, ext4, FAT, APFS)

Recovers files, examines timestamps, slack space, unallocated clusters, and hidden data inside a file system

Goal: recover deleted files, build timelines, detect hiding in slack/unallocated space

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What happens at Application/OS Analysis of Layered Design?

A

Highest layer – interprets OS and application-specific data.
Examines file contents
Goal: prove intent, malware behaviour, user actions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Why does the layered forensics model become increasingly abstract as you move from physical storage → volumes → file systems → applications?

A
  • Volume = storage location for user/application (partitions, RAID)
  • File system = organisation of files
  • Application & user activity
    Helps systematically recover evidence at every level.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

A forensic investigator lacks understanding of the layered model. What two major risks does this create?

Study These Flashcards
A

Opportunities for evidence to be hidden (at any layer)
Potential problems recovering, finding, and piecing together evidence
(increasing storage complexity and size)

24
Q

How does data location differ between HDD, CD/DVD, and SSD?

Study These Flashcards
A
  • HDD: Cylinder + Head + Sector (CHS)
  • CD/DVD: Track + Sector
  • SSD: Dies + Plane + Blocks

Each device needs a unique method to locate data → LBA was created to homogenise access.

25
What are bad sectors? How is this a forensic issue?
Sector that is unreadable leading to data corruption or loss Forensic issue: No perfect disk clone possible
26
What cases bad sectors?
Hard – physical defects Soft – magnetic defects, viruses, corruption
27
what does SATA-IDE controller do to bad sectors?
maintains bad sector map to relocate sectors
28
CHS Addressing (Cylinder-Header-Sector) Formulae
cylinders x heads x sectors x bytes
29
What are CHS used for?
Used to identify physical data blocks on HDD specifying precise location using parameter
30
What limitation does CHS addressing face and why?
250 GB drive only gives 8GB Fixed bit size for CHS addresses Assumption that heads (not cylinders) would increase Hardware growth outpaces the scheme
31
Problem and Solution for CHS addresing
Problem: cannot address large disks, many hardware translation issues Solution – LBA, BIOS performs address translation, less need to know physical geometry
32
LBA Addressing Formulae
LBA = (C x HPC + H) x SPT + (S – 1) HPC - max heads per cylinder = 255 SPT - max sectors per track = 63
33
Forensic benefits of LBA
Homogenises access to non-volatile memory Drives present data as linear series of logical blocks (each block = sectors) with unique LBA
34
Who ultimately converts an LBA address into the actual physical location on an HDD or SSD?
Disk firmware (not OS or BIOS) BIOS only translates OS requests; firmware performs final LBA → CHS or LBA → Flash mapping
35
Disk cloning - purpose, includes, why?
Purpose: Perfect sector-by-sector (block-by-block) copy of entire drive Includes: used space + unused/free space (deleted files, slack space, unallocated) why? Maintains chain-of-custody – evidence is not altered
36
Forensic Issue with Disk cloning
No perfect clone exists (different bad-sector mapping on each physical drive) Be prepared to explain this in court
37
Disk Wiping
Block-level overwriting of every sector with meaningless data. Makes original information permanently unrecoverable.
38
Disk Partitioning
Set of rules that defines how a physical storage drive is divided into separate logical sections (partitions)
39
Difference between MBR GPT features
Max disk size 2TB 9.4ZB Max partition size 2TB 256TB Max partitions 4 128 BIOS Support Yes No (UEFI only) UEFI Support Yes Yes standards for organising partitions
40
MBR
Master Boot Record - legacy simple
41
GPT
GUID Partition Table - modern, backup tables, protective MBR for compatibility
42
Forensic Issues – Partitioning (critical documents)
Operating system information Partition tables Unaddressed space Hidden partitions
43
Places to hide outside normal partitions (6)
Volume slack (unfilled track) Sectors/tracks falsely marked bad Disk geometry translation gaps Altered boot sector size Hidden partition (not in table) Unallocated space on disk / inside logical partitions
44
Different RAID levels
0 (striping) 1 (mirroring) 1+0, 5 (stripping with parity across drives) 6 (stripping with dual parity across drives)
45
Forensic Issues with RAID
Image each drive separately or the logical volume? Live image (RAID running) or dead image (boot CD)? Last MB of drive usually contains RAID metadata Logical reassembly needs exact config: level, order of drives, stripe size & direction
46
Key core functions of filesystem
Method to organise, store, name, retrieve files on a partition Acts as digital librarian: manages metadata + data blocks Controls access ensuring efficient storage/retrieval
47
Simplified Filesystem Structure (10)
metadata root structure folder name folder structure file name times (last accessed, modified created) owners/groups security permission pointers to data data
48
Why may a deleted file be recoverable from the disk.
File system deletion behaviour means data is not erased Only remove the directory entry and mark space as free. Actual data + metadata bits remain until overwritten by new data. Recovery possible until overwritten.
49
FAT File System
Tree of linked lists, cluster allocated to files Low performance, high simplicity Times: Creation, Modification, Access (no Changed time) Precision: 2 seconds
50
FAT Benefit and Drawback
compatible with everything but lacks security and handles power failures poorly
51
NTFS File System
A complex, robust database for Windows. MACE Timestamps (Modified, Accessed, Create, Entry modified) Precision: 100ns Block size: 4KB default (up to 2MB)
52
How does NTFS work?
Everything stored on Master File Table (MFT) - central index hold metadata for every file + directory on drive
53
Single Indirectiom
The file record points to a descriptor (the extent), which then tells the system where the actual data is.
54
EXT4 File System
The high-performance standard for Linux Block size: 4 KB default (range 1 KB–64 KB) Time precision: 1 nanosecond
55
How EXT4 works?
Uses inodes to store file metadata and extents (contiguous blocks of data) to reduce fragmentation Super Block: master reference (size, block size, inode counts, etc.) Block Groups: groups of blocks containing inode tables Inode: metadata structure (permissions, owner, timestamps, pointers) – no filename Bitmaps: track free blocks and inodes Inode pointers: direct + single + double + triple indirect
56
File System Forensic Use Cases
Recovery of Deleted Files/Folders Precise timing of File Actions Authentication/Authorisation Related to a File
57
From a forensic perspective, why is it useful that users cannot control the exact physical location of their data on the drive?
User cannot control physical location of storage User cannot control deletion of evidence from hard drive Opportunities to recover (partial) files, reconstruct timelines (especially NTFS), detect hidden data in alternate streams, etc.
CS3DF
flashcards
Decks in class (9)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions