▶ 5.3 Storing Data on a Hard Drive
While Tina and Bob probably don’t need to dust their USB drive for fingerprints or identify their culprit in court, they might want to perform a detailed investigation of the USB drive. To do that, they must analyze the file system. Before we look at the file system, we need to understand how hard drives work.
Even though we rely heavily on solid state drives and flash drives today, hard drive storage remains less expensive and is still widely used. Hard drives have heavily influenced how today’s file systems work.
These details help us understand what information a file system provides an investigator and what information it might hide. If we can retrieve a file after deleting it, a more clever program might give someone a way to actually hide data without deleting it.
A clever computer hacker, when arranging a hard drive, might set aside space for secret file storage that isn’t visible in the normal navigation windows. A really clever programmer might hide small bits of data, like encryption keys, in the “unused” space at the end of a file, or in “unusable” sections of the file system. To understand these tricks, we must understand hard drives and file systems.
Magnetic Recording and Tapes
Hard drives rely on magnetic recording. The easiest way to understand magnetic recording is to look at magnetic tapes. In both cases, the technique works the same:
When we move a magnet past a coil of wire, the coil produces a current.
The power and direction of the current indicates the strength and direction (“north” versus “south”) of the magnet. This allows us to read data from a magnetized surface.
The opposite also is true:
We can magnetize a metal surface if it moves past a coil of wire containing a current.
Again, the strength and direction of the magnetized surface reflects the strength and direction (“positive” versus “negative”) of the current.
A magnetic tape drive moves tape back and forth between two reels. We read and write data onto the moving tape as a series of magnetized spots. The coil of wire resides in the read/write head, shown at the top of FIGURE 5.1. As the motor moves the tape, it pulls the tape across the read/write head. When reading, the tape’s motion produces a current as data moves across the head.
FIGURE 5.1 A simple magnetic tape drive (photographed at the Computer History Museum, California).
Courtesy of Dr. Richard Smith.
Magnetic tapes and tape drives were the symbol of computers in the 1950s and 1960s. However, they suffered a fundamental weakness; they were limited to sequential access. In other words, we always encounter the data on the tape “in sequence.” We can’t get from the start of the tape to the middle without skipping over all of the data in between.
Hard Drive Fundamentals
Hard drives evolved in the 1950s to provide large amounts of low-cost storage for the “giant brains” of that era. Like magnetic tapes, they used magnetic techniques to store and retrieve data. Compared to magnetic tapes, hard drives provided random access to data, because it could find, retrieve, and rewrite any data on the hard drive in a relatively short time.
FIGURE 5.2 shows the inside of a modern hard drive. The read/write head is on the end of a long arm that hovers over the magnetized surface. The drive spins under the head to provide the motion required for reading or writing the magnetic data.
FIGURE 5.2 A typical hard drive.
Courtesy of Dr. Richard Smith.
On a hard drive, we record information on the surface of a spinning disk. In fact, disk drive is a traditional term for a hard drive. We record the information by magnetizing spots on the surface of the drive’s disk platters. The platters rotate around the spindle, driven by the moter. A read/write head hovers over each platter’s surface, held in place by a mechanical arm.
The hard drive’s basic mechanism has not changed since the 1950s, though the speed and capacity has increased dramatically. Like other computing equipment, hard drives have benefited from Moore’s law. The disk on a typical hard drive today is about 
in. (95 mm) in diameter, while some 1960s’ hard drives were over 4 feet (1300 mm) in diameter.
FIGURE 5.3 illustrates the hard drive’s basic geometry. We magnetize data in two dimensions on each platter. In one dimension, we move the read/write head inward or outward. When it stops at a particular distance, it inscribes a magnetized ring on the platter. That ring forms a track. Each track contains individual blocks of data called sectors.
FIGURE 5.3 Hard drive mechanism.
If we wanted to move from the first block to the last block on a magnetic tape, we had to wait while the drive moved the tape past every data block it contained. On a hard drive, we only need to wait for two relatively fast operations. First, the arm containing the read/write head moves from the first track to the last track. Second, we wait while the drive’s spin brings the final sector under the read/write head. This was lightning fast compared to magnetic tapes, even in the 1950s.
The simplest hard drives contain a single platter and a single read/write head. We record information on only one side of such platters. Larger drives often contain a second head to record on the other side of the platter. Some drives contain two or more platters, with an additional head for each side. Figure 5.2 shows a hard drive with two platters and four recordable surfaces.
The read/write heads are mounted on a set of arms that move together. When the drive moves the arm to a particular location on the disk surface, each head follows a matching track on its own surface. A very precise motor moves the arm assembly to specific locations on the disk surface; these locations specify the track locations.
A track represents a single ring of sectors recorded on one side of a platter. A cylinder represents all tracks recorded by the read/write head when it sits at a particular location. We get the highest performance out of a hard drive when all of our data resides on a single cylinder. If the data doesn’t fit on a single cylinder, we optimize our performance if the data resides on adjacent cylinders.
Dissecting a Hard Drive: First, and most important, never dissect a working hard drive. The disk heads must hover slightly above the disk surface, and will “crash” into the surface if it tangles with an obstacle like a dust mote. It is impossible to open a hard drive without making it unusable, unless performed in a clean room by an expert.
Vendors use airtight sealing tape and several small screws to attach the drive cover to the drive body. The cover comes loose once all screws are removed and the tape is slit to loosen the drive cover. Note that some screws may be covered by labels.
There will always be at least one label saying “Tampering with this label will void the warranty.” This is because hard drives are not designed to be opened. Never dissect a working hard drive.
5.3.1 Hard Drive Controller
To read and write data reliably, we must move the head assembly very precisely over the desired track. We also must be sure to read or write the correct sector on the track. Modern hard drives use a special circuit, the drive controller, to operate the head assembly and select the correct sector.
FIGURE 5.4 illustrates the parts of a controller using a hardware block diagram. Such diagrams show the major components in a hardware device, and the signals that pass between those components.
FIGURE 5.4 Hardware block diagram of a hard drive controller.
A modern controller resides on a circuit board packaged with the rest of the drive hardware. Typically, the hard drive accepts commands from the CPU sent to it across a high-speed bus. For example, a command may direct the drive to read data from one or more sectors. The command identifies the starting sector and the number of bytes to read. The controller moves the mechanism to the first sector and retrieves the data from the magnetized surface. As the data arrives from the mechanism, the controller transmits it back across the bus.
A controller typically contains the components shown in Figure 5.4. Connections between components carry control signals (marked “C”), data signals (marked “D”), or both. Here is a description of each component:
■ Bus interface connector—a socket for connecting the drive to a high-speed bus. Modern drives have a SATA connector or possibly an ATA or IDE connector. These are described in Section 2.1.1.
■ Bus interface—circuits that convert the commands and data that flow between the bus and the command logic.
■ Command logic—circuits that convert the commands into a series of operations performed on the hard drive mechanism.
■ Buffer—a large block of RAM that stores data temporarily on its way to or from the hard drive mechanism. The mechanical operations are time sensitive. The buffer makes it easier to synchronize the bus data transfers with the hard drive’s mechanical motions.
■ Fetch/store data—circuits that directly control the head motor to select tracks, and that retrieve or rewrite individually addressed sectors.
Hard drive speed depends on two variables: rotational speed and head motion. Modern drives in desktop computers may rotate at speeds from 5400 to 10,000 revolutions per minute (RPM), with faster drives being more expensive. Track-to-track head motion is significantly slower. While it may take microseconds to move data to or from a track without moving the head, it may take milliseconds to move data if the drive has to move the head between tracks. The data transfer speed is even slower if the heads must move between innermost tracks and outermost tracks.
Modern drive controllers try to automatically correct for bad sectors. The controller detects a possibly bad sector if the sector’s cyclic redundancy check occasionally fails. When it detects a bad sector, it redirects the sector’s address to a different, reliable sector elsewhere on the drive. This takes place automatically and the operating system might never detect the change.
5.3.2 Hard Drive Formatting
If we look at a hard drive before we install an operating system, the drive contains nothing except the numbered sectors. Each sector stores a separate block of data. The hard drive controller uses the sector number as the sector’s address.
When we perform a low-level format on a hard drive, we tell the controller to initialize the raw sectors themselves. Most hard drives use a sector size of 512 bytes, though some devices may have sectors as large as 2048 (2K) bytes. Each sector consists of three parts as shown in FIGURE 5.5: the header, the data, and the check value.
FIGURE 5.5 Low-level format of a hard drive sector.
The header contains the sector’s numerical address and other information for the controller. Most drives number sectors consecutively, though older drives used to number them by track. The controller always checks the sector address when reading or writing. Although today’s hard drives usually format all sectors identically, some special drives allow variations in the sector format.
The data area, naturally, contains the sector’s data. The sector’s check value helps the controller detect errors in the sector’s data. Magnetic storage is very reliable, but the magnetic properties fail once in a while. We look closer at error detection in Section 5.4.1.
As shown in FIGURE 5.6, a hard drive is like a huge post office with millions of numbered boxes (the sectors). We find each box by number. We can store or retrieve a fixed amount of data via each box. When we store or retrieve data from one box, we don’t affect the contents of other boxes. Unlike post office boxes, though, individual hard drive sectors rarely are large enough to store an entire file. When a file is larger than a sector, it resides in a series of boxes. To read the information, we must retrieve the data from every box in the series.
FIGURE 5.6 Sectors and clusters on a hard drive.
High-Level Format
The high-level format of a hard drive refers to the layout of its file system. Different file systems store particular information in particular places, as described later in this chapter. Typically, the high-level format divides the drive into groups of sectors called clusters (Figure 5.6). Each file contains one or more clusters. The file system keeps track of the clusters. When we create a new file or add more data to an existing file, the system locates an unused cluster and adds it to the file.
Fragmentation A file may consist of several clusters in a row or its clusters may be scattered across the hard drive. The scattering often is called fragmentation. It can slow the system down when we work with those files. This is why people occasionally run a “defragment” utility on their hard drive. The utility moves the clusters in each file so that they are contiguous; this makes it faster to access the files.
Fragmentation also refers to wasted space on the hard drive. Most files contain a “fragment” of wasted space at the very end. If a file ends exactly at the end of a cluster, then there is no wasted space. More often, the file ends short of the end of the cluster. The remaining space can’t be used in another file, so the space is wasted.
Quick Format When we perform a “quick format” on a hard drive, we initialize the file system information. This doesn’t disturb the existing sector addresses, and it ignores most of the data on the drive. Instead, it recreates all of the basic information for creating files, and gives the drive a single, empty “root” directory. If we had any files on the hard drive before reformatting, the process discards those files.