The hard disk drive provides a means of storing data persistently within a computer system; In computer forensics this would be called non-volatile memory. By abusing the techniques used to store data on the drive, it is possible to hide data, a sort of anti forensics. Detecting if there is hidden data can easily be achieved by comparing the reported space available on the drive to the actual space on the drive itself. If a physical drive of 120GB is partitioned to only 80GB, then where is the other 40GB? That 40GB could be used by the user as a container for hidden files, alternatively it could be used as a recovery means which were setup by the factory for prebuilt systems. This topic can be put into another blog post however, as first it’s vital to understand the key components of a HDD on a physical level, in the next post on this topic I will talk about the logical side of how data is stored on this medium.
The following diagram illustrates the internal components of a generic HDD. All modern HDDs have this very similar layout, where differences may be the physical size, number of platters, or slight variation to the layout/shape to the components.
Data is magnetically stored on the platter with the use of positive/negative charges to differentiate between the values 1 and 0 which represent bits on a computer system. The platter rotates around the spindle which can reach speeds ranging from 5400 RPM (Rotations Per Minute) and 15,000 RPM. These bits of data are written to the platter by the read/write head; this component can only perform the reading of bits from the platter, or writing to it by applying a charge; it can not do both in synchronous. The read/write head is attached to the actuator arm which pivots on the actuator axis. This allows the head to move along the platter surface as it spins. This movement is controlled by the voice recoil actuator which functions by passing a electrical current through it; depending on the strength of the current, determines how much the arm moves. When the device is powered down, the actuator arm goes to it’s parking location. This is so the read/write head does not scratch the surface of the platter when it’s not in use. Some modern hard drives implement a free fall monitor that detects when the device is being dropped or moved suddenly; this then controls the actuator arm to go to the resting position to prevent any damage from occurring during operation of the device. The platter is prone to damage from very small particles, which could lead to severe data loss and because of this reason an air filter is put in place to keep the enclosed environment as clean as possible during operator to catch these particles.
This post covers only a brief overview of the physical components of the hard disk drive storage medium. In later posts I will write about file systems which is the data structure computer systems use to organise and store data.