Chapter 3 — Physics for computing | Engineering Digital forensics and malware analysis

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 3 — Physics for computing

Lesson map

Lesson 03 published. Map, example, EX007.

flowchart TD
  N0["Learning outcomes"]
  N1["3.1 Magnetic storage"]
  N2["3.2 Flash storage"]
  N3["3.3 TRIM and garbage collection"]
  N4["3.4 Volatility"]
  N5["3.5 Static and handling"]
  N6["3.6 Heat and data"]
  N7["Optical and removable media"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX007"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["3.1 Magnetic storage"]
  N2["3.2 Flash storage"]
  N3["3.3 TRIM and garbage collection"]
  N4["3.4 Volatility"]
  N5["3.5 Static and handling"]
  N6["3.6 Heat and data"]
  N7["Optical and removable media"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX007"]

[Learning outcomes]
    |
    v
[3.1 Magnetic storage]
    |
    v
[3.2 Flash storage]
    |
    v
[3.3 TRIM and garbage collection]
    |
    v
[3.4 Volatility]
    |
    v
[3.5 Static and handling]
    |
    v
[3.6 Heat and data]
    |
    v
[Optical and removable media]
    |
    v
[Worked example] --> [Exercise EX007]

Learning outcomes

You will (1) explain how data are stored physically on magnetic and flash media; (2) relate physics to forensic recovery; (3) explain why solid-state drives change acquisition; (4) handle evidence safely.

3.1 Magnetic storage

Hard disk drives store bits as magnetised regions on spinning platters read by a head flying nanometres above the surface. Physical shock can crash the head, which is why seized drives are packed against vibration.

Because the head reads each sector magnetically, overwritten data on a modern drive is generally gone; recovery relies on sectors that were never reused. Ageing drives develop weak sectors that return errors on first read, which is why imaging tools retry and log those sectors. A drive that clicks or will not spin up goes to a specialist instead of being forced through repeated attempts that could finish it off.

3.2 Flash storage

Solid-state drives store charge in floating-gate or charge-trap cells. Cells wear out, so a controller spreads writes (wear levelling) and maps logical blocks to physical pages. The host sees logical addresses only.

The mapping between logical and physical locations is the controller's private business, so the same logical block can sit on different physical pages from one day to the next. An examiner imaging through the normal interface gets the logical view, which is what the file system uses. Chip-off or controller-level techniques can see more, but they are specialist, destructive or both, and the lab treats them as a separate decision.

3.3 TRIM and garbage collection

When the operating system deletes a file it may send TRIM, telling the drive those blocks are free. The controller can then erase them in the background, even while powered for imaging. Deleted data on SSDs may therefore be unrecoverable, unlike on many hard drives.

This has two practical consequences. An SSD should be imaged promptly, because the controller may keep erasing in the background while the drive is powered. And two images taken minutes apart may differ in unallocated areas even though nobody wrote to the drive. Priya's notes record power-on time and imaging start time, so a later hash difference in free space can be explained rather than mistaken for tampering.

3.4 Volatility

RAM holds charge only while powered. RFC 3227 orders evidence by volatility — registers and cache, then memory, then disk — because the most volatile vanishes first.

In practice, the volatility order turns into a first-responder decision. If a laptop is running and shows an unlocked encrypted volume, capturing memory first may preserve keys that would be lost at power-off. If the device is already off, there is nothing volatile left to collect and it is not switched on to find out. Priya's checklist asks which state the device was in and who decided what, at what time.

3.5 Static and handling

Electrostatic discharge can damage electronics, so anti-static bags and grounding are routine. NIST SP 800-101r1 also discusses isolating mobile devices from networks to stop remote changes.

Network isolation for phones can mean flight mode, a shielded bag or both, and each option has trade-offs. A shielded bag can drain the battery as the phone searches for signal, and switching on flight mode means touching the device. The handling record notes which method was used, when and by whom, because a later question about remote wiping or message arrival will depend on it.

3.6 Heat and data

Heat does not slowly erase modern drives at room temperatures, but extreme heat damages hardware; evidence stores keep moderate conditions.

Storage conditions matter more for batteries and for degraded media than for data in healthy drives. A swollen phone battery is a fire risk and is isolated in a fireproof container. Old optical media and tapes can delaminate in damp storage. The evidence store logs temperature and humidity, so if a later read fails, the lab can show whether storage conditions could have played a part.

Optical and removable media

Optical discs store data as pits read by a laser and degrade with scratches and age; memory cards are flash and share SSD behaviour. Each medium has its own handling and acquisition notes, and the examiner records the medium type, condition and serial number on intake.

Worked example

An examiner images a laptop SSD twice, an hour apart, while it remains powered by a write blocker. The hashes differ. Hugo explains a plausible cause: background garbage collection changed unallocated pages that the drive reports. The examiner records both hashes and the explanation rather than discarding one.

Synthetic case. The two hashes are invented.

Errors and limits

Controller behaviour varies by vendor and firmware; claims about recoverability need testing on the specific model.

Exercises

EX007 — TRIM effect. Why may deleted data be unrecoverable on an SSD? Rubric: 3 = TRIM lets controller erase freed blocks; 2 = partial; 1 = SSDs encrypt; 0 = none.
EX008 — Volatility order. Order RAM, disk and CPU cache by RFC 3227 volatility. Rubric: 3 = cache, RAM, disk; 2 = one swap; 1 = reversed; 0 = none.
EX009 — Differing hashes. How should two differing SSD image hashes be documented? Rubric: 3 = record both, explain likely cause; 2 = partial; 1 = discard one; 0 = none.

Synthesis

Physics explains why media behave differently and why acquisition order and handling matter.

Continue studying — chapter 03 of 50

← Chapter 02 (draft) · Course chapter index · Chapter 04 (draft) →