Chapter 9 External Hardware Interfaces

8/8/2019 Chapter 9 External Hardware Interfaces

http://slidepdf.com/reader/full/chapter-9-external-hardware-interfaces 1/24

Chapter 9 External Hardware Interfaces

Graymark DFnDR Trainer 9-1

INTRODUCTIONMany devices are available for external connection to computers. These devices

include:• Hard Drives

• Optical Drives • Tape Drives

• Memory Cards

• USB Drives

• Printers

• Scanners

• FAX Machines

To enable communication between an external device and a computer, there must

be two key elements:• Hardware interface

• Software interface

There are several popular hardware interfaces. Each hardware interface typically

has a corresponding software interface. The hardware interfaces include:• USB (Universal Serial Bus)

• FireWire (IEEE 1394)

• Parallel Port

Chapter 9ExternalHardwareInterfaces

KNOWLEDGE OBJECTIVESAfter you successfully complete this chapter you will have the knowledge to:

1. List the different type of external hardware interfaces

2. Explain the USB standards

3. Describe the FireWire standards

4. Identify parallel ports and cable connectors

5. Distinguish a SATA port from an eSATA port

6. Recognize an infrared portChapter 9 External Hardware Interfaces

9-2 Graymark DFnDR Trainer• eSATA (External SATA)

• Infrared

UNIVERSAL SERIAL BUSUniversal Serial Bus (USB) is a serial communication hardware interface. USB

devices are connected through various devices, including:• USB hub

• Keyboard hub

• Monitor hub

• Computer motherboard

A USB system needs a host, in either the computer or USB hub. According to theUSB rules, only one host is allowed on the USB bus. USB is designed to support

low-speed peripheral devices such as:• Keyboards

• Mice • Printers

• Scanners

• Modems

• Network Interface Controllers (NICs)



• Digital Cameras

• Video Monitors

• PDAs • Joysticks

• Camcorders

ICON The icon used to identify USB connectors and devices is shown in Figure 9-1.

Figure 9-1. USB iconUSB 1.1 The USB 1.1 standard was developed by Compaq, DEC, IBM, Intel, Microsoft,

NEC, and Northern Telecom. The primary goal was to provide a seamless way for

computer users to connect devices. The goal was to develop a true plug-and-play

system without requiring a computer user to upgrade internal components of the

computer system.

The USB bus supports digital video standards MPEG-1 and MPEG-2. USB

transfers data at a rate of 12 Megabits per second for the USB 1.1 standard. USB

1.1 can support up to 127 USB devices. Device speed will vary from 1.5 MB/sec

to 12 MB/sec. The lower rate is intended for input devices such as mice and

keyboards. The high-end rate of 12 MB/sec is intended for storage devices, as

well as video and audio devices.

The USB 1.1 standard allows hot pluggable or hot swapping. This means that aUSB device can be installed or detached without powering OFF the computer.Chapter 9 External Hardware Interfaces


Plug-and-play is supported through appropriate USB device drivers via the

operating system or manufacturer.

The USB bus is self-powered or powered through a USB hub supplying between

100 mA and 500 mA of current. A self-powered USB bus is the type found in a

computer system.

USB 2.0 The USB 2.0 standard transfers data at rates of 480 MB/sec. USB 2.0 is also

designed to be downward compatible with USB 1.1 devices.

USB HUB A USB hub allows several USB devices to be connected to one USB computer

port. A USB hub has peripheral ports to which external devices can be connected

The number of peripheral ports on a hub can vary from two to 16. A 4-port USBhub is shown in Figure 9-2. Figure 9-2. 4-Port USB hub

DATATRANSMISSIONData flowing from the device to the host is called upstreaming. Data flowing from

the host to the device is called downstreaming. The host, whether it is a USB hub,

motherboard USB host, or USB expansion card, is connected electrically through

wires.

CABLES &

CONNECTORSA USB 1.1 standard cable is 20 AWG, shielded, twisted-pair (STP), four

conductors (2 pairs). The maximum cable length between devices cannot exceed 5

meters (16 feet).

There are two USB connector types:• Type A

• Type B

There are also three sizes of USB connectors:• Standard



• Mini

• Micro

Figure 9-3 shows the various types and sizes of USB connectors. You can easily

see the relative sizes of the connectors. There will be close ups of the connectors

later in this section.Chapter 9 External Hardware Interfaces

9-4 Graymark DFnDR Trainer Figure 9-3. USB cable connector types & sizes

TYPE AThe Type A connector is used on computers or other hosts. This connector is

thinner and wider than Type B; it is more rectangular than Type B. A Type A port

and cable connector are shown in Figure 9-4 and Figure 9-5. Figure 9-4. USB Type A port

Figure 9-5. USB Type A cable connector

TYPE BThe Type B connector is used on peripheral devices such as printers. This

connector is thicker and narrower than Type A; it is more square than Type A. A

Type B port and cable connector are shown in Figure 9-6 and Figure 9-7.Chapter 9 External Hardware Interfaces


Figure 9-6. USB Type B port

Figure 9-7. USB Type B cable connector

Some manufacturers alternatively use the terms Series A and Series B.Upstream connectors are Type B, and downstream connectors are Type A.

Microsoft specifies that computers sold with Windows must have at least four

externally accessible USB ports.

MINI USB CONNECTORSAs the need for smaller connectors emerged, a Mini USB connector was

developed. A Mini USB cable connector is shown in Figure 9-8. Figure 9-8. Mini USB cable connector

MICRO USB CONNECTORSEven smaller on-the-go demanded USB connectors that were smaller than theMini USB. The Micro USB connector, shown in Figure 9-9, is smaller than the

Mini USB connector.Chapter 9 External Hardware Interfaces

9-6 Graymark DFnDR Trainer

Figure 9-9. Micro USB cable connector

OPERATINGSYSTEM SUPPORTNot all operating systems will fully support USB. In other words, all operating

systems are not fully compatible with USB. The operating system, motherboard

BIOS, and motherboard chip set must all support USB for the best performance.

Windows 95 OSR 2.1 offered limited support for USB. Windows 98, Windows

XP, Windows 2000 and MAC OS 8.1 offer expanded support for USB and USB

devices.

INTRODUCTION In this exercise, you will examine USB connectors and cables.

INVESTIGATIONCOMPUTER SETUPNone.

PROCEDURE 1. Retrieve the following items:



• Notebook Computer

• eSATA Forensic Bridge

• USB Cable (part of eSATA Forensic Bridge Set) • USB Thumb Drive

2. Examine your USB Thumb Drive. Identify the USB Connector.

It has a Type A USB Connector.

3. Examine your Notebook Computer. Identify the USB Connectors.It will probably have four Type A USB Connectors.

4. Examine the USB Cable from your eSATA Forensic Bridge. Identify theUSB Connectors.

It has a Type A USB Connector on one end and a Mini USB Connector on

the other end.

EXERCISE 9.1 - EXAMINE USB DEVICES, CABLES & PORTS

SKILL OBJECTIVESAfter you successfully complete this exercise you will have the skills to:

1. Identify the different USB ports and cable connectorsChapter 9 External Hardware Interfaces


5. Examine your eSATA Forensic Bridge. Identify the USB Connector.It has a Mini USB Connector.

INSTRUCTOR’S EVALUATIONYour instructor will evaluate and grade your work in this exercise.

COMMENTS

INITIALS: __________ DATE: __________

FIREWIRE (IEEE 1394)FireWire is a high-speed serial bus interface that is designed to transfer large

amounts of data. Typical uses include:• Graphic images

• Video files • Audio files

• Live video & audio

ICON The icon used to identify FireWire / IEEE 1394 connectors and devices is shown

in Figure 9-10. Figure 9-10. FireWire / IEEE 1394 icon

Originally designed by Apple Computer Corporation and Texas Instruments, the

bus became the IEEE 1394 standard. Current brand names for IEEE 1392 are:• FireWire (Apple)

• i.LINK (Sony) RATINGPoor Good ExcellentITEM 1 2 3 4 5Followed Instructions

Completed WorkThorough & ClearAccurate GRADETOTAL + + + + =


9-8 Graymark DFnDR Trainer• Lynx (Texas Instruments)

The IEEE 1394 standard and FireWire support Plug and Play and hot plug.

FIREWIRE 400(IEEE 1394A)



The original IEEE 1394a specification provides for data transfer rates of 100, 200,

and 400 MB/sec. There are two types of FireWire 400 connectors:• 4-Pin

• 6-Pin

The 4-pin and 6-pin connectors are shown in Figure 9-11 and Figure 9-12. Figure 9-11. 4-Pin FireWire 400 cable connector

Figure 9-12. 6-Pin FireWire 400 cable connectorFIREWIRE 800(IEEE 1394B)The IEEE 1394b specification provides for data transfers of 800, 1600, and 3200

MB/sec. FireWire 800 uses a 9-pin connector, shown in Figure 9-13. Figure 9-13. 9-Pin FireWire 800 cable connector

DATATRANSMISSIONData transmitted over the wire is isochronous. This allows real time transfer of

video data, which is data intensive.Chapter 9 External Hardware Interfaces


CABLES &CONNECTORSUp to 62 devices can be placed on the bus. The maximum cable length between

devices is 4.5 meters.

OPERATINGSYSTEM SUPPORTNot all operating systems fully support IEEE 1394. Just as with USB, the

operating system, motherboard BIOS, and motherboard chip set must support

IEEE 1394 for the best performance.

Windows 95 OSR 2.1 offered limited support for USB. Windows 98, Windows

2000, and MAC OS 8.1 offer support for IEEE 1394. Be sure to check with the

manufacturer of the IEEE 1394 device and the operating system to determine if support is available.

INTRODUCTION In this exercise, you will examine FireWire ports and cables.


PROCEDURE 1. Retrieve the following items:• Notebook Computer

• eSATA Forensic Bridge

• FireWire Cable (part of eSATA Forensic Bridge Set)

2. Examine your Notebook Computer. Identify the FireWire Connector.

It will probably have one 4-pin FireWire Connector.3. Examine the FireWire Cable from your eSATA Forensic Bridge. Identify

the FireWire Connectors.

It has a 9-Pin FireWire 800 Connector on each end.

4. Examine your eSATA Forensic Bridge. Identify the FireWire Connectors.

It has one 6-Pin FireWire 400 Connector and two FireWire 800

Connectors.

EXERCISE 9.2 - EXAMINE FIREWIRE DEVICES, CABLES &



PORTS


1. Identify the different FireWire ports and cable connectorsChapter 9 External Hardware Interfaces



COMMENTS

INITIALS: __________ DATE: __________

PARALLEL PORTAs is the case with most technology, standards evolve and improve over time. The

parallel port interface is no exception. There are two parallel port standards:• Standard

• Enhanced Parallel Port (EPP)

STANDARD The standard parallel port data transfer rate is approximately 150 KB/sec. The

interface provides unidirectional communication. This means that data could only

be sent from the computer to the printer. Data could not be sent from the printer tothe computer. The cable length cannot exceed 12 feet.

ENHANCEDPARALLEL PORT(EPP)The IEEE 1284 standard is also known as Enhanced Parallel Port (EPP). This

standard provides high-speed bidirectional communication. The EPP

enhancement was designed to transfer data at a rate of 600 KB/sec through 1.5

MB/sec. The maximum cable length is 32 feet.

ICON The icon used to identify parallel port connectors and devices is shown in

Figure 9-14. Figure 9-14. Parallel port iconRATINGPoor Good ExcellentITEM 1 2 3 4 5Followed InstructionsCompleted WorkThorough & ClearAccurate GRADETOTAL + + + + =



Until printer manufacturers began providing USB interfaces on their products, the

most common printer interface was the parallel port. The most common device

connected to the parallel port was a printer, therefore, the parallel port icon is a

printer.Even though the parallel port icon looks like a printer, the port can be used for any

parallel device. The most popular devices with a parallel interface include:• Printers

• Scanners

• FAX machine

CABLES &CONNECTORS



The parallel interface uses a large number of connections. The minimum number

of wires in a parallel interface cable is 18. A thick cable is used to connect printers

and other parallel devices to a computer.

DB-25 CONNECTORThe parallel port connector on a computer is a 25-pin female D type connector,

commonly referred to as a DB-25 connector. The female DB-25 computer

connector is shown in Figure 9-15. Figure 9-15. DB-25 female connector on computer

A parallel cable is used to connect a device with a parallel interface to a computer.

The end that connects to a computer is a male DB-25 connector. This cable

connector is shown in Figure 9-16. Figure 9-16. DB-25 male cable connector



The other end of a parallel cable will have one of two different connectors:• DB-25 male

• Centronics

CENTRONICS CONNECTOR

The first printer with a parallel interface was manufactured by Centronics. Theyinstalled a 36-pin connector on the printers. Since Centronics designed the

connector, it was, and still is, referred to as a 36-pin Centronics connector. A

drawing of the 36-pin Centronics cable connector is shown in Figure 9-17. Figure 9-17. 36-Pin Centronics cable connector

INTRODUCTION In this exercise, you will examine parallel ports and cables.


PROCEDURE 1. Retrieve the following items:• Parallel Cable from FRED Large Cables Storage Container

2. Examine the Parallel Cable from the FRED Large Cables Storage Container.

Identify the Parallel Connectors.It has a DB-25 male connector on one end and a 36-pin Centronics

connector on the other end.

3. Examine the back of the Desktop Evidence Computer. Identify the

Parallel Connector.

It has a DB-25 female connector.

EXERCISE 9.3 - EXAMINE PARALLEL CABLES & PORTS


1. Identify the parallel ports and cable connectorsChapter 9 External Hardware Interfaces

Graymark DFnDR Trainer 9-13INSTRUCTOR’S EVALUATIONYour instructor will evaluate and grade your work in this exercise.

COMMENTS

INITIALS: __________ DATE: __________

eSATAIn 2004, a modified version of the SATA hard drive interface was developed for



use as an external hardware interface.

ICON There is no standard icon used to identify eSATA connectors. There is, however,

an icon that is often printed on eSATA devices. This printed icon is shown in

Figure 9-18. Figure 9-18. eSATA icon

CABLES &CONNECTORSThe SATA connector was modified for the eSATA external hardware interface. It

has several features that the SATA connector does not have, including:• More rugged

• Resists accidental unplugging

• No L-shaped key

• Improved electro-static discharge protection

An eSATA cable connector is shown in Figure 9-19. Two eSATA connectors on a

computer are shown in Figure 9-20. A connector that is mounted to a piece of

equipment is usually referred to as a chassis connector.RATINGPoor Good ExcellentITEM 1 2 3 4 5

Followed InstructionsCompleted WorkThorough & ClearAccurate GRADETOTAL + + + + =



Figure 9-19. eSATA cable connector

Figure 9-20. eSATA chassis connectors

The maximum eSATA cable length is 2 meters (6.6 ft).

INTRODUCTION In this exercise, you will examine SATA and eSATA ports and cables.

INVESTIGATIONCOMPUTER SETUP

1. If Windows is not already running, boot to Windows.2. Be sure that you are logged on as the User.

PROCEDURE 1. Retrieve the following items:

• SATA Mobile Drive Rack

EXERCISE 9.4 - IDENTIFY SATA & ESATA CABLES &PORTS


1. Identify SATA and eSATA ports and cable connectorsChapter 9 External Hardware Interfaces


• eSATA Forensic Bridge • SATA Cable (part of eSATA Forensic Bridge Set)

• eSATA Cable (part of eSATA Forensic Bridge Set)

2. Examine the SATA Mobile Drive Rack. Identify the SATA Connector.

It has one SATA Connector on the back side.

3. Examine the SATA Cable from your eSATA Forensic Bridge. Identify the

SATA Connectors.

It has SATA Connectors on both ends.

4. Examine your eSATA Forensic Bridge. Identify the eSATA Connector.



It has one eSATA Connector.

5. Examine the eSATA Cable from your eSATA Forensic Bridge. Identify

the eSATA Connectors.

6. It has eSATA Connectors on both ends.

INSTRUCTOR’S

EVALUATIONYour instructor will evaluate and grade your work in this exercise.

COMMENTS

INITIALS: __________ DATE: __________

INFRAREDConsumer devices have used the infrared interface for many years. Devices using

the infrared interface include remote controls for TVs, VCRs, DVD players and

audio equipmentRATINGPoor Good ExcellentITEM 1 2 3 4 5Followed InstructionsCompleted WorkThorough & ClearAccurate GRADETOTAL + + + + =



Infrared interfaces use as a very narrow beam of invisible light. The interface

communication is established by having two infrared devices pointed toward each

other without anything in between. This is referred to as line-of-sight alignment.

The distance between infrared devices can range up to 3 meters depending on the

model.

Although less popular today, some computers and peripheral devices were

manufactured with an infrared port. These peripheral devices include:• Printers

• Modems

• Network interface controllers (NICs) • PDAs

An external infrared port is shown in Figure 9-21. This external port is connected

to a computer via a USB cable. Figure 9-21. External infrared port

ICON The icon used to identify eSATA connectors and devices is shown in Figure 9-22 Figure 9-22. Infrared port icon

SUMMARYAfter successfully completing this chapter, you have the knowledge to:

1. List the different type of external hardware interfaces

2. Explain the USB standards

3. Describe the FireWire standards

4. Identify parallel ports and cable connectors5. Distinguish a SATA port from an eSATA port

6. Recognize an infrared portChapter 9 External Hardware Interfaces


This completes Chapter 9. Proceed to the next chapter.

NOTESChapter 9 External Hardware Interfaces




Chapter 10 Hard Disk Drives


INTRODUCTIONHard disk drives are the primary memory storage device used in computers. A

wide variety of hard drives has been used in computers. Each type of hard drive

requires different cables and electronic interface. A well-equipped digital

forensics laboratory will be able to analyze any type of hard drive.

More importantly, the digital forensics examiner must have knowledge of all types

of hard drives and a thorough understanding of how each drive operates. This

chapter provides a thorough discussion of hard drives.

In this chapter, the following aspects of hard disk drives will be covered:• Specifications

• Electro-Mechanical Components

• Hard Drive Types

• Hard Drive Operation

• Encoding Schemes

SPECIFICATIONSGeneral hard drive specifications include:• Capacity • Physical Size

• Throughput Rate

Chapter 10HardDiskDrives

KNOWLEDGE OBJECTIVESAfter you successfully complete this chapter you will have the knowledge to:

1. List hard disk drive specifications

2. Describe the electro-mechanical components in a hard drive

3. Identify the different types of hard drive interfaces4. Explain how a hard drive operates

5. Understand the purpose of a hard drive jumper

6. List the various encoding schemes used in hard drivesChapter 10 Hard Disk Drives

10-2 Graymark DFnDR Trainer• Access Time

• Mean Time Before Failure

• Mean Time Data Loss • Latency Time

• Interleave

• Defect Map

CAPACITY Capacity is the total formatted storage ability of the drive. There are three levels

of size used to expressed the capacity:• Megabytes (MB) - millions of Bytes

• Gigabytes (GB) - billions of bytes

• Terabytes (TB) - trillions of bytes

PHYSICAL SIZE Hard drives are manufactured in a range of sizes. As technology advances are

made, the physical size of hard drives is reduced and the memory storage capacity

increases. The first hard drives were physically very large and stored a relatively

small amount of data. Today’s hard drives are much smaller and have a significantly large capacity.

The physical size of a hard drive is given in inches. The dimension refers to the

width of the drive. The most common hard drive sizes today are:



• 3.5”

• 2.5”

• 1.8”

Figure 10-1 shows the relative sizes of several hard drive sizes. Two types of the

3.5” and 2.5” drives are shown. Figure 10-1. Different hard drive sizes

THROUGHPUTRATEThroughput is the rate at which data is transferred from the read/write heads to the

system bus. Throughput is measured in Kilobytes per second.

ACCESS TIME Access Time (also referred to as seek time) is the average time the read/write

heads take to move over a specified cylinder and sector. Access time is measured

in either milliseconds or microseconds.Chapter 10 Hard Disk Drives


MEAN TIMEBEFORE FAILURE

Mean Time Before Failure (MTBF) is the average time the manufacturer hasdetermined between consistent failures of a drive component. MTBF is measured

in thousands of hours.

MEAN TIME DATALOSSMean Time Data Loss (MTDL) is the average time it will take for a loss in data to

occur.

LATENCY TIME Latency Time is the amount of time it takes for the correct cylinder to come

directly under the read/write heads.

INTERLEAVE Interleave is a ratio (5:1, 3:1, 1:1) that indicates how many revolutions the platters

will rotate under the read/write heads before the next sector is found.

DEFECT MAP Defect Map is a table written into the BIOS of the hard drive that contains specificareas of the platters that have physical damage.

ELECTRO-MECHANICAL COMPONENTSAll hard disk drives have the same electro-mechanical components. The design of

each component varies by hard drive manufacturer and model.

The term hard disk was originally used to distinguish it from flexible or floppy

disks. As the name implies, a disk that is hard is used as the memory storage

media in a hard disk drive.

The hard disk drive components consist of:• Electronic circuit board

• Mechanical assembly

The electronic circuit board is mounted to the hard drive. The electronic circuit

board contains:• Microprocessor

• ROM

• Servo control circuits

• Read/write bus

• Data cable connector

• DC power connector

• Drive select header

As shown in Figure 10-2, the mechanical assembly consists of:



• Disks or platters

• Spindle

• Head arms • Read/write heads

• Head actuator



Figure 10-2. Typical hard drive components

The hard disk drive is sealed when manufactured. The disks/platters spin at a rate

of 5400 rpm or more. The read/write heads do not touch the platters; they “fly”

over the platters at a height of only 2 to 3 micro inches. (A human hair is 3000

micro inches thick) If the drive is opened, any dirt or dust will damage the heads

and also will cause physical damage to the platters.

PLATTER Depending on the hard disk drive size, the drive can have one or more platters

encased in the housing. The platter consists of an aluminum disk coated with a

highly polished magnetic media.

FORMATTINGA new hard drive is not formatted. Prior to installing an operating system, a

partition must be created using the FDISK utility. It must then have a high levelformatting using the DOS FORMAT command.

After formatting, the platters are divided into tracks and sectors, as shown in

Figure 10-3. A sector is the smallest addressable area on the hard disk drive. A

sector is usually 512 bytes. Figure 10-3. Disk & sector layout

HARD DRIVE CYLINDERA track on a hard disk drive is referred to as a cylinder. The cylinder is comprisedof all the tracks located in the same physical area on all the platters. The read/

write heads read from and write to these areas at the same time.

SKEWINGAs the read/write heads move to an adjacent cylinder to continue a read or write

operation, it often misses the proper track. The heads must wait until the data track Chapter 10 Hard Disk Drives


they are seeking returns on the next revolution. Although the wait time may seem

miniscule, the time accumulated over thousands of revolutions would

significantly slow the read/write process if engineers had not built in

compensating designs.

Track SkewingTrack skewing is a method in which the read/write heads read or write data to

multiple platters at the correct timing interval. The platters are designed so when

data located in track 1, sector 8 on platter 1 has been read, data located in track 1,

sector 8 on platter 2 is in position to be read. This is illustrated in Figure 10-4. Figure 10-4. Track skewing

Cylinder SkewingCylinder skewing is utilized to change from cylinder to cylinder without waiting

for the platter to make one revolution. When cylinder 1, sector 8 of platter 1 has

been read, cylinder 2, sector 1 is ready to be read, as shown in Figure 10-5. Figure 10-5. Cylinder skewing

Both track and cylinder skewing are functions controlled by the ROM. Current

hard disk drives are considered high-density drives. The magnetic media that is

distributed on the aluminum platter is of very high coercivity. This allows more





tracks, sectors, and larger allocation units. More data, therefore, can be written to

the drive.

The hard disk drive uses a method of recording called zone bit recording. This

method allows more sectors to be written to the outer most cylinders with a

smaller number of sectors written to the inner most cylinders. The sectors (pieshaped wedges) become smaller nearer the center of the platter.

HARD DRIVE TYPESThere are several types of hard drives. They are categorized by the type of

hardware interface. The most common types are:• MFM

• RLL

• ESDI

• IDE

• EIDE

• SCSI

• SATA

• SSD DRIVEINTERFACESEach type of hard drive requires a different drive interface. The drive interface is

the electronic circuitry and connectors that interface the hard drive to the

computer. The following components comprise of the drive interface:• Controller Electronics

• Encoder Chip

• ROM

• Buffers

• Cache Buffer

• Power Connector

• Data Connector

MFM The oldest type of personal computer hard drive is Modified Frequency

Modulation (MFM). The disk drive control electronics is separate from the hard

drive. A controller input/output (I/O) board is used to connect the hard drive to the

computer. MFM drives are not commonly used today.

RLL Run Length Limited (RLL) is the second oldest personal computer hard drive.

Like the MFM, the disk drive control electronics is separate from the hard drive.

A controller input/output (I/O) board is used to connect the hard drive to the

computer.

ESDI The enhanced small disk interface (ESDI) protocol provided a small improvement

over RLL. The ESDI is the type of drive used in the IBM PS/2 series of personal

computers. It is not in common use today.

IDE / ATA As technology advanced, engineers designed the disk drive electronics into the

hard drive itself. Originally, this was called Integrated Drive Electronics (IDE).

Later, it was renamed to Advanced Technology Attachment (ATA). Both terms

are used interchangeably today.Chapter 10 Hard Disk Drives


IDE drives are available in a variety of sizes. A typical 3.5” IDE hard disk drive is

shown in Figure 10-6.



Figure 10-6. Typical 3.5” IDE hard disk drive

CABLES & CONNECTORSIDE was a major change in the drive electronics. The electronic interface circuitry

was integrated into the hard drive. The IDE drive has two connectors and a

header:• Power Connector, 4-Pin

• Data Connector, 40-Pin• Drive Select Header

POWERThe power connector is a 4-pin connector. This connector is also referred to as a

Molex connector. Molex is the connector manufacturer.

The DC power connector supplies power to the hard disk drive. DC voltage used

by the hard disk drive is 12 VDC, 5 VDC and common.

Refer to Figure 10-6 to identify the male connector used on the hard drive. The

power connector on the power supply cable is a female connector, as shown in

Figure 10-7. Figure 10-7. 4-Pin connector on power supply cable

DATA

IDE / ATA hard drives incorporate a parallel data connection. This parallelconfiguration requires a 40-pin data connector. A single 40-pin cable connects the

drive to an IDE controller card or the motherboard if it has an onboard IDEChapter 10 Hard Disk Drives


controller. Integrating the electronics directly to the drive enhances the drive’s

performance.

Refer to Figure 10-6 to identify the male data connector used on the hard drive.Figure 10-8 shows an IDE data cable. Figure 10-8. IDE data cable

DRIVE SELECT HEADERRefer to Figure 10-6 to identify the male drive select header on the hard drive.

This header is used to select one of several operational functions:• Master - configures the drive as the primary boot drive

• Slave - used if a second drive is connected to the same IDE cable

• Cable Select - allows the BIOS to determine if the drive is the primary boot drive

• Slave Present - used if the drive will be used as a slave drive when the primary drive

is set for Cable select

HEADERS & JUMPERSHard drives, motherboards and many other computer devices may have several

open-frame pin connectors called headers. Each header is used for one of two

different functions:• Connect other computer components to the motherboard • Serve as a switch

Headers are available in different sizes, such as 2-pin, 3-pin, 4-pin, etc. Typical 2-

pin and 3-pin headers are shown in Figure 10-9. Figure 10-9. Typical 2-pin & 3-pin headers

Headers Used as ConnectorsHeaders that are used to connect components together function the same as other

electrical connectors. A wire or cable to be connected to a motherboard or other

component will have a plug on the end of the wire or cable. The plug will be

mated with the motherboard or other component to connect the two components.Chapter 10 Hard Disk Drives




Headers Used as SwitchesHeaders that function as switches use a special connector plug called a shorting

jumper or jumper. Figure 10-9 illustrates a 2-pin jumper. The jumper can connect

two adjacent header pins together.

Together, a header and jumper operate like a switch to select different modes of

operation. Figure 10-10 illustrates a jumper used to select a function by

connecting pins 1 and 2 together. Figure 10-10. Header and jumper used as a switch

If a jumper is placed on two adjacent header pins, the switch is closed. If the same

two header pins do not have a jumper, the switch is open. Jumpers are removable

and reusable, and can be used on different components.

As shown in Figure 10-11, jumpers are comprised of two pieces:• Plastic body

• Shorting strip

Figure 10-11. Jumper construction & installation

Figure 10-11 also shows how to use long nose pliers to install and remove a

jumper from a header.

When a jumper is removed from a header, the shorting strip may remain attached

to the header; with only the plastic body removed. If this happens, the header pinsremain connected or closed. After you remove a jumper, always check to makesure the shorting strip is inside the plastic body.

If the shorting strip is not in the plastic body, it is probably still on the header.

Carefully remove the shorting strip with a small pair of pliers. The shorting strip

can then be reinserted into the plastic body.Chapter 10 Hard Disk Drives


IDE BUS VERSIONSThe IDE interface is available in several different configurations:• XT IDE (8-bit)

• AT Attachment (ATA)

• IDE (16-bit)

• MCA IDE (16 bit Micro-Channel)

EXTENDED TECHNOLOGY (XT)The XT has an 8-bit bus that uses a 40-pin interface cable.

ADVANCED TECHNOLOGY ATTACHMENT (ATA)The ATA uses a 40-pin interface cable.

INTEGRATED DRIVE ELECTRONICS (IDE)The standard IDE has a 16-bit bus.

MICRO-CHANNEL ARCHITECTURE (MCA)The MCA has a 16-bit architecture and uses a 72-pin interface cable.

EIDE An improved version of IDE is the Enhanced Integrated Drive Electronics (EIDE)

drive. Unlike IDE drives, the EIDE drive protocol doesn’t require much CPU

processing time. EIDE hard drives must work with an EIDE hard drive controllerfor best performance.

EIDE INTERFACEATA-2 or EIDE (Enhanced IDE) is an extension of the original ATA that includes

features such as PIO (programmed I/O) and DMA modes. These are basically

performance enhancing features.

The main benefits of ATA-2 are twofold:• Increased capacity due to an advance in BIOS to work with drives larger than 504

MB



• Faster data transfer rates

ATAPI ATA Packet Interface (ATAPI) is one of most common standards found on IDE/

EIDE drives, as well as CD-ROM and internal ZIP drives. ATAPI is interface

hardware that is located on the drive’s electronic circuit board. With an ATAPI

interface in place, the drive does not need a software driver.Windows 9X, Windows NT, Windows 2000, Windows ME, Windows XP and

Linux all support the ATAPI interface. If a drive needs to operate in a DOSenvironment, however, then separate software drivers have to be installed.

SATA The original Advanced Technology Attachment (ATA) protocol uses a 40-wire

parallel data interface. The parallel ATA system was modified to create the Serial

Advanced Technology Attachment (SATA) protocol.

Transfer rates for Serial ATA begin at 150MBps. The thinner ATA serial cables

also allow a more efficient airflow inside a computer. Serial ATA cables can be as

long as one meter. A typical SATA drive is shown in Figure 10-12.Chapter 10 Hard Disk Drives


Figure 10-12. Typical SATA hard drive

CABLES & CONNECTORSThe SATA system employs a 4-wire serial connection to the computer. SATA datatransfer rates are faster that ATA rates. There are four varieties of SATA

connectors:• Standard

• Slimline

• Micro

Standard The Standard SATA cable is used on standard SATA hard drives. The connector

has 22 pins:• 7 pins for data

• 15 pins for power

A close up of the SATA hard drive connectors is shown in Figure 10-13.

Chapter 10 Hard Disk Drives10-12 Graymark DFnDR Trainer

Figure 10-13. SATA drive connectors

SlimlineThe Slimline SATA cable is used on Slimline SATA hard drives. The connector

has 13 pins:• 7 pins for data


MicroThe Micro SATA cable is used on 1.8” SATA hard drives. This connector has 16 -

pins:• 7 pins for data


DATASATA drives can be easily distinguished from ATA drives by observing the data

connector or cable. ATA cables are very wide, while SATA cables are very

narrow, as shown in Figure 10-14. The SATA cable is on the left, and the IDE

cable is on the right. Figure 10-14. SATA & IDE (ATA) data cables

POWERSATA drives may have one of three different power connectors:



• Standard

• Slimline

• Micro



IDE (ATA) power cable connectors cables have 4 large pins, while SATA power

cable connectors have 15 small pins, as shown in Figure 10-15. The SATA powercable connector is on the left, and the IDE (ATA) power cable connector is on the

right. Figure 10-15. SATA & IDE (ATA) power cable connectors

SATA IISATA II drives have the same interface and other physical characteristics. The

primary difference is that the SATA II has a much faster data transfer rate.

INTRODUCTION In this exercise, you will examine various hard drives to identify characteristics

that differentiate the types of hard drives.

INVESTIGATIONCOMPUTER SETUP1. If Windows is not already running, boot to Windows.

2. Be sure that you are logged on as the User.

PROCEDURE 1. See your instructor for the procedure.

EXERCISE 10.1 - IDENTIFY DIFFERENT TYPES OF HARD

DRIVES


1. Identify different types of hard drives

NOTE

This is an optional exercise. Your instructor will advise you of the procedure.Chapter 10 Hard Disk Drives



COMMENTS

INITIALS: __________ DATE: __________

IMAGE DRIVEYour Trainer includes a SATA Hard Drive. You will use this SATA Drive to

capture images from evidence devices. Since it will be used to capture images, it

will be referred to as your Image Drive.

To protect your Image Drive, you will mount it in a mobile hard drive rack. A

mobile hard drive rack is an external hard drive housing. The rack provides

physical and electro-static protection for a hard drive.Like hard drives, mobile racks are available for different sizes and types of hard

drives. Your Mobile Rack, shown in Figure 10-16, is a 3.5” SATA type to match

your 3.5” SATA Image Drive. RATINGPoor Good ExcellentITEM 1 2 3 4 5Followed InstructionsCompleted WorkThorough & ClearAccurate GRADETOTAL + + + + =





Figure 10-16. 3.5” SATA Mobile Rack

INTRODUCTION In this exercise, you will mount your SATA Image Drive into the Mobile Rack.

INVESTIGATION

COMPUTER SETUPNone.

PROCEDURE 1. Retrieve the following items:• SATA Mobile Rack

• SATA Hard Drive

• Phillips Screwdriver

2. Open the Mobile Rack Latch, as shown in Figure 10-17.

EXERCISE 10.2 - MOUNT SATA IMAGE DRIVE IN MOBILE

RACK


1. Mount a hard drive in a mobile rack Chapter 10 Hard Disk Drives


Figure 10-17. Opening Latch

3. Swing the hinged Access Door open, as shown in Figure 10-18. Figure 10-18. Swinging Access Door open

4. Slide the Drive Tray out, as shown in Figure 10-19.

If the Drive Tray does not slide out, it may be locked. Insert one of the

Keys that was supplied with your Mobile Drive Rack in the Lock to

unlock the Drive Tray. Figure 10-19. Sliding the Drive Tray out

5. Pull the Drive Tray completely out of the Rack, as shown in Figure 10-20.Chapter 10 Hard Disk Drives

Graymark DFnDR Trainer 10-17 Figure 10-20. Drive Tray out of Rack

6. The Rack has a Metal Cover that must be removed. There is a plastic

Button labeled PUSH next to the OPEN label on the Metal Cover. As

shown in Figure 10-21, while pressing on the PUSH Button, slide the

Metal Cover toward the rear of the Rack. Figure 10-21. Sliding the Metal Cover off the Rack

7. Remove your SATA Hard Drive from its Carton.

8. Remove the Hard Drive from its Anti-Static Bag. Save the Carton and

Anti-Static Bag.

9. Holding the Hard Drive at an angle, carefully place it in the Drive Tray, as

shown in Figure 10-22. Figure 10-22. Placing SATA Hard Drive in Drive Tray



10. Check the Rear Panel of the Mobile Rack. The Hard Drive’s Power and

Data Connectors should be visible through the slot in the Rear Panel.

11. Place the Hard Drive flat inside the Drive Tray. It should look like

Figure 10-23. Figure 10-23. Hard Drive flat inside Drive Tray

12. While holding the Hard Drive flat inside the Drive Tray, turn the

assembly over.



13. Using the four Screws provided with the Mobile Drive Rack, secure the

Hard Drive to the Drive Tray, as shown in Figure 10-24. Do not

overtighten the Screws. Figure 10-24. Securing Hard Drive to Drive Tray

14. Turn the Drive Tray over.

15. As shown in Figure 10-25, replace the Metal Cover on the Drive Tray. Be

sure it snaps into place.Chapter 10 Hard Disk Drives


Figure 10-25. Replacing Metal Cover on Drive Tray

16. Position the Drive Tray in front of the Mobile Drive Rack, as shown in

Figure 10-26. Figure 10-26. Positioning Drive Tray and Rack

17. Slide the Drive Tray into the Rack.

18. Carefully close the hinged Access Door. As you close the Door, the Drive

Tray will be moved further into the Rack. The Hard Drive Connectors

will be mated with the Mobile Drive Rack Connectors.

19. Close the Latch.

INSTRUCTOR’S EVALUATIONYour instructor will evaluate and grade your work in this exercise.RATINGPoor Good ExcellentITEM 1 2 3 4 5Followed InstructionsCompleted WorkThorough & ClearTOTAL + + + + =



COMMENTS

INITIALS: __________ DATE: __________

SCSI The Small Computer System Interface (SCSI) is a high performance disk driveinterface system. SCSI drives require a special I/O controller board. SCSI is

pronounced “skuzzy”. The interface can access up to seven hard disk drives.

SCSI INTERFACESCSI is a system level interface. A SCSI device can be a CD drive, hard disk

drive, scanner or other device. The SCSI system requires a host adapter thatinterfaces with other devices. SCSI allows for a mix of different SCSI devices. All

of the devices attached to the host adapter are part of the SCSI bus.

A typical computer system can support up to four SCSI buses. Each SCSI bus can

support up to seven devices plus the host adapter for a total of 28 SCSI devices.

THROUGHPUTThe throughput of newer SCSI host adapters can be 160 MB/sec or more and are

capable of supporting up to 15 devices per channel using 32-bit host adapters. Thehost adapter can be plugged into an EISA, ISA or PCI expansion slot, or

integrated onto the motherboard.

DATA TRANSFER RATESThe current SCSI standards include:• Standard SCSI (SCSI-1)• Fast SCSI or Fast Wide SCSI (SCSI-2)

• Ultra-2 or Wide Ultra-2 SCSI (SCSI-3)

• Ultra 160



Several host adapters support the standards:• 8-Bit

• 16-Bit

• 32-Bit

CABLES, CONNECTORS & TERMINATORSAccurate GRADERATING

Poor Good ExcellentITEM 1 2 3 4 5TOTAL + + + + =



The internal cable that SCSI uses is a flat ribbon cable with either a 50 or 68-pin

interface. SCSI cables are either type A or type P.• Type A is a 50-pin cable and cannot exceed 6 meters (nearly 20 feet)

• Type P is a 68-pin cable that cannot exceed 3 meters (nearly 10 feet)

External CablesThere are several external SCSI cables available. They have different

combinations of connectors.

Figure 10-27 illustrates a SCSI cable with a 50-pin connector at one end and a 68-

pin connector on the other end. In Figure 10-27, the 50-pin connector is on the leftside, and the 68-pin connector is on the right side. Figure 10-27. SCSI cable connectors

TerminatorsOn the SCSI bus the first and last SCSI device on the bus must be terminated. The

host adapter and internal SCSI devices have a built in termination. Depending on

the SCSI device, it may have one of three types of terminating devices: Passive,

Active, and Forced Perfect Termination.• Passive Termination - A network of resistors (used in Normal SCSI)

• Active Termination - uses voltage regulators to ensure the termination voltage is

constant (used in Fast and Wide SCSI)



•

Forced Perfect Termination (FPT) - A diode clamping circuit is used to ensure any

voltage spikes or signal overloads are eliminated. (FPT termination can be found as

FPT-3, FPT-18, and FPT-27)

• Normal SCSI uses FPT-3 or FPT-18



• Wide SCSI uses FPT-27

Depending on the manufacturer, the terminating resistor can usually be enabledand disabled using a jumper on the device. When daisy-chaining the SCSI

devices, an internal pass-through SCSI terminator may be used.

Figure 10-28 illustrates an assortment of SCSI terminators and adapters.Chapter 10 Hard Disk Drives

10-22 Graymark DFnDR Trainer Figure 10-28. SCSI terminators & adapters

SCSI TYPESSCSI is also identified as either single-ended SCSI (normal) or differential SCSI.

Each type can be identified by its own symbol located on the SCSI device. See

Figure 10-29 for the SCSI symbols.

Single-ended and differential SCSI devices cannot be mixed on a single SCSI bus. Figure 10-29. Single-ended and differential SCSI universal symbols

Single-Ended SCSI Single-Ended SCSI is so named because for every electrical signal that is

transmitted, a single wire must exist for the signal to travel on.

Differential SCSI

Differential SCSI uses two wires for the signal to travel on. This two-wireinterface makes the Differential SCSI less prone to noise and interference.

CONFIGURING SCSIChapter 10 Hard Disk Drives


Refer to Figure 10-30 for the following discussion. Although SCSI configuration

is a little more complex, SCSI devices have to be configured just as with IDE type

drives. The host adapter card is the first thing to be installed and configured. Each

SCSI device is then set with a unique ID number (1 through 7 or greater per bus)

through jumpers or switches on the device.

The last device on the SCSI bus is terminated. Each device is then added, one by

one, to the SCSI host adapter. If needed, a driver or software is loaded so the

system can recognize and access the device. Figure 10-30. Typical SCSI hookup diagram

External SCSI devices will have an input and output port. An external terminating

resistor is attached to the output port of the last device in the chain.

SCSI IDUp to seven SCSI devices plus the host adapter can be attached on a single SCSIbus. A unique identification number called the SCSI ID must be used to identify

each device. SCSI ID numbers are from 0 through 7.

The host adapter is configured for SCSI ID 7 (highest priority ID). Older adapter

cards required you to set SCSI IDs in sequence from that point (6, 5, 4, etc.)

Newer SCSI adapter cards can use an ID in any sequence as long as the ID does

not conflict with anything else on the SCSI bus. Read the manufacturer’s

information about the exact location of the SCSI ID jumpers.SCSI RULES• Both ends of the SCSI bus must be terminated

• Set the device to a unique, non-conflicting, ID number. The host adapter will usually

be set for ID 7 while other devices in the chain are set in descending order (older

cards) or any order (newer cards)


10-24 Graymark DFnDR Trainer• If you are configuring SCSI hard drives, the drive must be partitioned and formatted

prior to the installation of an operating system



A SCSI drive with a 68-pin data connector is shown in Figure 10-31. Figure 10-31. Typical SCSI hard drive

SOLID STATE A solid-state drive (SSD) does not have platters or any moving parts. It uses flash

type memory. Some SSDs use SRAM or DRAM instead of flash memory. This

type of solid state drive is usually referred to as a RAM Drive.An SSD acts like (emulates) a hard drive. This makes it very easy to replace a

hard drive with an solid state drive. Because an SSD has no moving parts, it ismuch more rugged than hard drives.

HARD DRIVE OPERATIONThere will be occasions when the digital forensics examiner must understands

how a hard drive operates. This can be the case when there is difficulty reading a

hard drive, or when the examiner must testify about a hard drive’s operation.

STANDARD CHS Standard CHS (Cylinder Head Sector) is also called Normal. Standard CHS

limits

the drive to addressing 16 heads and 1,024 cylinders, which would give a

maximum capacity of 504 MB.

EXTENDED CHS Extended CHS is also referred to as Large. When chosen, a translated logical

geometry is used to communicate between the drive and BIOS. In order to displaythe logical drive parameters, divide the cylinder count by 2 and multiply the

number of heads by 2. This feature allows the BIOS to recognize a hard drive that

is larger than 504 MB.

LOGICAL BLOCKADDRESSINGLogical Block Addressing (LBA) linearly addresses sectors at Cylinder 0, Head 0,

and Sector 1 as LBA 0, then addresses everything, in sequence, to the last physical

cylinder of the disk (the standard SCSI addressing scheme). In LBA mode each

sector stores 512 Bytes of data.

Theoretically, LBA can address hard drive sizes as large as 128 GB. Without a

translated CHS, however, the BIOS will only recognize a drive as large as 8 GB,Chapter 10 Hard Disk Drives


which translates to LBA limits of 1,024 cylinders, 256 heads, and 63 sectors per

track. The hard drive must be able to support LBA mode in order to be properly

configured.

DRIVE INTERFACE Hard disk drives can also be characterized by interface type.

On virtually all current computers, the drive interface will be onboard the

motherboard.

ENCODING SCHEMESHard disk drives can also be characterized by encoding method.

Encoding is the manner in which data is written to and read from the hard disk

drive. Various types of encoding methods have been used in hard disk drivesincluding Modified Frequency Modulation (MFM) and Run Length Limited

(RLL).

The data recorded onto the magnetic media is stored as 1s and 0s. Data placed on

the disk by the read/write heads is binary data in an encoded form. The drive

electronics has an Encoder/Decoder Chip (ENDEC) that takes the raw data and

converts it into magnetic pulses during the encode/write operation. During the

read/decode operation, it also converts the flux transitions or polarity reversals



picked up by the read head and converts them back into digital data.

When the digital data is applied to the read/write heads, the head creates a

magnetic field domain on the disk media with specific polarities. When a positive

current is applied to the write heads, the magnetic domains are polarized in one

direction. When a negative current is applied to the heads, the magnetic domains

are polarized in the opposite direction. As the write head is being pulsed, it is

writing data to the platters.As the head encounters a group of magnetic domains during the read operation, it

senses any changes in the magnetic domain polarity or flux reversals. Two

encoding methods are in use today.

FM ENCODING Although FM encoding is not used today, it did lead to the development of MFM.

With FM encoding, a flux reversal in each bit cell is recorded to indicate logic 1.

No flux reversal is indicated as logic 0. Each bit requires a transition cell. Logic 1

is recorded as a clock flux reversal followed by a data flux reversal. Logic zero is

seen as no clock reversal. Since there are two transition cells, the amount of data

the drive can hold is reduced.

MFM ENCODING Twice the amount of data is written in the same number of flux reversals and

clock speeds are doubled in MFM encoding. Floppy disk drives use MFMencoding. As explained earlier, early hard drives used FM encoding and were

limited in their capacity.

RLL ENCODING Run Length Limited (RLL) encoding is used on all hard drives today including

SCSI drives. RLL increases the drive capacity by over 50 percent. In RLL, groups

of bits are written or read as a unit, then combined to generate specific patterns of Chapter 10 Hard Disk Drives


reversal. Clock and data are combined in these patterns. RLL is defined from two

specifications of this code, which is the minimum number (run length) and the

maximum number (run limit) of transition cells allowed between two flux

transitions. The version of the RLL scheme is written as RLL2, 7. There can be as

few as two and as many as seven transition cells separating two flux transitions.SUMMARYAfter successfully completing this chapter, you have the knowledge to:

1. List hard disk drive specifications2. Describe the electro-mechanical components in a hard drive

3. Identify the different types of hard drive interfaces

4. Explain how a hard drive operates

5. Understand the purpose of a hard drive jumper

6. List the various encoding schemes used in hard drives

This completes Chapter 10. Proceed to the next chapter.

Chapter 9 External Hardware Interfaces

Documents

Transcript of Chapter 9 External Hardware Interfaces