Elementary Information Security, 3rd Edition

▶ 5.3 Storing Data on a Hard Drive

While Tina and Bob probably don’t need to dust their USB drive for fingerprints or identify their culprit in court, they might want to perform a detailed investigation of the USB drive. To do that, they must analyze the file system. Before we look at the file system, we need to understand how hard drives work.

Even though we rely heavily on solid state drives and flash drives today, hard drive storage remains less expensive and is still widely used. Hard drives have heavily influenced how today’s file systems work.

These details help us understand what information a file system provides an investigator and what information it might hide. If we can retrieve a file after deleting it, a more clever program might ...