System Forensics, Investigation, and Response, 3rd Edition

Storage Formats

Working with forensics, you need to be familiar with a variety of storage formats. Specifically, you should be familiar with the various hard drive types, file systems, and journaling. This section reviews a variety of storage and file formats and explores additional issues with storage formats.

Magnetic Media

Although mobile devices, like smartphones and tablets, are a growing part of forensic work, computers are still the biggest target of forensic investigations. Most computers utilize magnetic media. Hard drives and floppy drives are types of magnetic media. Essentially, the data is organized by sectors and clusters, which are in turn organized in tracks around the platter. A typical sector is 512 bytes, and a cluster ...