Course three disk partition schemas.
Throughout this course we're going to take a look at the logical and physical drives.
I don't understand why we need to know the difference between those and
how that will impact us.
During a forensic investigation, we're going to take a look at sectors and
clusters.
We're going to come to understand how to recognize those structures on disks and
what they mean to us.
I'm going to look at different partitioning methods,
mainly would petition table and master boot record and
we're going to learn how to locate the partitions by reading the table.
We're going to learn how to recognize the data structures such as
what is in the master boot record in the master partition table.
Also the partition table and we're going to learn how to identify different
types of file systems by looking at the data structures Mulele one,
we're going to talk about logical and physical drives and
what the differences are and how we recognize that.
We're going to talk about the components of the physical hard drive.
Well, our physical drive, our regular spitting disk is encased and
underneath the case, if we were to take that apart, we could see some platters
would seek a spindle in the middle which spins the platters.
We would see some heads that go back and forth across the disk and write and
read data to and from the disk and the actuator arm,
which is what aligns the heads and moves them back and forth across the platters.
This is a view of a physical disk and
you can see the platters look kind of like a CD or DVD and
in the middle we have our spindles and then we have the actuator arm.
And at the end of the actuator arm we have the head.
Now when we look at the platters, The first platter is known as platter zero.
That would be the one on top, the side facing upward towards us,
With besides zero, the bottom of that would beside one.
And then underneath that the next platter would be known as platter one And
its top side, it's side facing up,
would be side to the side facing down would be site three.
The heads worked in much the same way the top head would behead zero on the first
platter, her head on the bottom of platter, zero would behead one.
Then going down to platter, one would have had to on The top and
head three on the bottom.
We want to talk about the logical structure is what we just talked about was
the physical layout of a spitting.
A traditional hard drive, not an SSD, but a regular spinning drive.
What we're going to talk about now is going to talk about the logical structures
on that drive first I want to talk about is low level formatting.
This is laying down the tracks and sectors on the surface of the hardest.
This is done at the manufacturer's,
it's not something you would have control over as a user when you buy a disk.
It comes with the tracks and sectors already laid down on it.
Now a track is the centric circle that goes around the disk and
you can see it represented our diagram there as a white circle.
Those would be considered the tracks, they're smaller in the middle and
as you get out towards the edge of the disk, they become larger sectors
are I like to think of them as little pie pieces, you can see them
represented there in the yellow and they are wedges within the disk.
So a sector could take up many tracks within it.
But the sector is just a little pipi slice of the disk in what you want
to remember is is the smallest muted of storage on the platter.
The sector is the smallest unit unit of storage on the platter And
they're usually 512 bytes in size.
And we'll talk more about that as we go through.
Now, a cluster is a group of sectors, is the easiest way to explain that and
that is something that is done during high level formatting and talk more about that
in the next section, but they can vary in size depending on the size of your disk.
What you want to remember about.
A cluster is a cluster has to do with allocation.
A cluster is used to store data.
It's the area we assign to store.
Data.
Data is stored in clusters.
It's allocated or stored in clusters.
In our next module.
We're going to talk more about sectors and clusters.