Data Recovery Lab Blog: Data recovery and computer forensics

A hard disk commonly known as a HDD (hard disk drive or hard drive or formerly known as “fixed disk”), is a non-volatile storage device which stores digitally encoded data on rapidly rotating platters with magnetic surfaces. Strictly speaking, “drive” refers to an entire unit containing multiple platters, a read/write head assembly, driver electronics, and motor while “hard disk” (sometimes “platter”) refers to the storage medium inside the HDA(Hard Drive Assembly)itself.

HISTORICAL BACKGROUND:

Hard disks were originally developed for use with computers. Nowadays, applications for hard disks have expanded beyond computers to include digital video recorders, digital audio players, personal digital assistants (PDAs), and digital cameras. In 2005 the first mobile phones to include hard disks were introduced by Samsung Group and Nokia. The need for large-scale, reliable storage, independent of a particular device, led to the introduction of software configuration such as Redundant Array of Inexpensive Disks or RAID, hardware configuration such as Network Attached Storage (NAS) devices, and systems such as Storage Area Networks (SANs) for efficient access to large volumes of data on a network. The capacity of hard disks has grown dramatically over time. The first commercial disk, the IBM RAMAC introduced in 1956, stored 5 million characters (about 5 megabytes) on fifty 24-inch diameter platters. (Huge dimensions compared to today’s hard drive which size 3.5″ for desktop hard drives, 2,5″ for laptop hard drives, 1,8″ and 1″ for ultra portable laptops, PDAs, digital cameras and other mobile devices.)

With early personal computers in the 1980s, a disk with a 20MB capacity was considered large. In the latter half of the 1990s, hard disks with capacities of 1GB (1000MB) and greater became available. As of 2007, the lowest-capacity desktop computer hard disk still in production has a capacity of 20GB, while the largest-capacity internal disks available now are 1TB (1000GB) on 5 platters. The exponential increases in disk space and data access times for hard disks has enabled the commercial viability of consumer products that require large storage capacities, such as the Apple iPod digital music player, the TiVo personal video recorder, and web-based email programs.

HOW IS A HARD DRIVE OR STORAGE MEDIA IS ACCESSED?
Hard disk drives are generally accessed using one of a number of available bus types, including ATA (IDE, EIDE), Serial ATA (SATA), SCSI, SAS, IEEE 1394, USB, and Fibre Channel. (More of this later.) Most of the world’s hard disks are now manufactured by just a handful of large firms such as Seagate, Maxtor, Western Digital, Samsung, and the former drive manufacturing division of IBM, now sold to Hitachi. Fujitsu continues to make specialist notebook and SCSI drives. Toshiba is a major manufacturer of 2.5-inch and 1.8-inch notebook drives. In 2003, hard disk pioneer IBM sold the majority of its disk division to Hitachi, who renamed it Hitachi Global Storage Technologies.

HARD DRIVE BUS TYPES:

ATA:
Advanced Technology Attachment (ATA) is a standard interface for connecting storage devices such as hard disks and CD-ROM drives inside personal computers. Many terms and synonyms for ATA exist, including abbreviations such as IDE, ATAPI, and UDMA. ATA standards only allow cable lengths up to 18 inches (up to 450 mm) although cables up to 36 inches (900 mm) can be readily purchased, so the technology normally appears as an internal computer storage interface. It provides the most common and the least expensive interface for this application. Although the standard has always had the official name “ATA”, other names such as Integrated Drive Electronics (IDE) and Enhanced IDE (EIDE) have also been adopted for marketing purposes. Although these new names originated in branding convention and not as an official standard, the terms EIDE or E-IDE often appear interchangeably with IDE and ATA.

PATA:
PATA is actually the same as ATA. With the introduction of Serial ATA around 2003, this configuration was retroactively renamed to Parallel ATA (P-ATA), referring to the method in which data travels over wires in this interface to distinguish it from Serial ATA (SATA).

Serial ATA:
In computer hardware, Serial ATA (also SATA or S-ATA) is a computer bus primarily designed for transfer of data to and from a hard disk. It is the successor to the legacy Advanced Technology Attachment standard (ATA, also known as IDE). This older technology is now known as Parallel ATA (PATA) to distinguish it from Serial ATA.

SATA150:
First-generation Serial ATA interfaces, also known as SATA150, run at 1.5 gigahertz. Because Serial ATA uses 8B/10B encoding at the physical layer, this results in an actual data transfer rate of 1.2 gigabits per second (Gbit/s), or 150 megabytes per second. This transfer rate is only slightly higher than that provided by the fastest Parallel ATA mode, UDMA-133. However, further increasing PATA bandwidth is somewhat impractical, but the relative simplicity of a serial link and the use of LVDS have allowed Serial ATA to scale easily.

SATA300:
With the release of the NVIDIA nForce4 chipset in 2004, the maximum throughput has been doubled to 300 MB/s (2.4 Gbit/s). This increased data rate specification is very widely referred to as “Serial ATA II” (“SATA II”); however, the official website for the SATA standard states that this is a misnomer, SATA II being the name of the organization formed to author the Serial ATA specifications. Indeed, the increased data rate capability was only one of many that were defined by the SATA II committee. The Serial ATA standard organization has since changed names, and is now “The Serial ATA International Organization”, or SATA-IO. SATA-IO plans to further increase the maximum throughput of Serial ATA to 600 MB/s around 2007. Physically, the cables used are the most noticeable change from Parallel ATA. The Serial ATA standard defines a data cable using seven conductors and 8 mm wide wafer connectors on each end. SATA cables can be up to 1 m (40 in.) long. PATA ribbon cables, in comparison, carry either 40- or 80-conductor wires and are limited to 45 cm (18 in.) in length. Serial ATA drops the master/slave shared bus of PATA, giving each device a dedicated cable and dedicated bandwidth. Unlike early PATA connectors, SATA connectors are keyed — it is not possible to install cable connectors upside down. The Serial ATA standard also specifies a power connector sharply differing from the four-pin Molex connector used by PATA drives and many other computer components. Like the data cable, it is wafer based, but its wider 15-pin shape should prevent confusion between the two. The seemingly large number of pins are used to supply three different voltages if necessary — 3.3 V, 5 V, and 12 V. The same physical connections are used on 3.5-in. and 2.5-in. (notebook) hard disks.

Features allowed for by SATA but not by PATA include hot-swapping and native command queueing. To ease their transition to Serial ATA, many manufacturers have produced drives which use controllers largely identical to those on their PATA drives and include a bridge chip on the logic board. Bridged drives have a SATA connector, may include either or both kinds of power connectors, and generally perform identically to native drives. They may, however, lack support for some SATA-specific features. As of 2004, all major hard drive manufacturers produce either bridged or native SATA drives. SATA drives may be plugged into Serial Attached SCSI (SAS) controllers and communicate on the same physical cable as native SAS disks. SAS disks however may not be plugged into a SATA controller.

External SATA:
Initially SATA was designed as an internal or inside-the-box interface technology, bringing improved performance and new features to internal PC or consumer storage. Creative designers quickly realized the innovative interface could reliably be expanded outside the PC, bringing the same performance and features to external storage needs instead of relying on USB or FireWire (IEEE 1394) interfaces. Called external SATA or eSATA, customers can now utilize shielded cable lengths up to two meters outside the PC to take advantage of the benefits the SATA interface brings to storage. SATA is now out of the box as an external standard, with specifically defined cables, connectors, and signal requirements released as new standards in mid-2004. eSATA provides more performance than existing solutions and is hot-pluggable.

Key benefits of eSATA:
-Up to six times faster than existing external storage solutions: USB 2.0 and FireWire.
-Robust and user friendly external connection
-High performance, cost effective expansion storage
-Up to 2-m shielded cables and connectors

Applications of eSATA include External Direct Attached Storage for notebooks, desktop, consumer electronics and entry servers.Many existing external hard drives use USB and/or FireWire. These interfaces are not nearly as fast as SATA when compared using peak values, and can compromise drive performance. USB and IEEE 1394 external drives are ATA drives with a bridge chip that translates from the ATA protocol to USB or IEEE 1394 protocol used for the connection. These interfaces require encapsulation or conversion of the transmit data and then de-capsulation after the data is received. This protocol overhead reduces the efficiency of these host buses, increases the host CPU utilization or requires a special chip to off-load the host. The results of eSATA are dramatic and with no protocol overhead issues as with USB or IEEE 1394. The eSATA storage bus delivers as much as 37 times more performance. This ability is perfect for using an array of drives with performance striping behind the eSATA host port. The typical cable length is two meters (six feet); long enough to reach from a floor-mounted PC to a drive placed on the desktop. The compliance is defined in the SATA II: Electrical Specification, as the Gen1m and Gen2m specifications for 1.5 Gb/s and 3.0 Gb/s respectively.

Nowadays, most PC motherboards have an eSATA connector. For those motherboards which do not have onboard eSATA, eSATA slots can be installed through the addition of an eSATA host bus adapter (HBA) or bracket connector for desktop systems or with a Cardbus or ExpressCard for notebooks. Motherboard manufacturers gradually started introducing eSATA connectors in late 2005 making the addition of eSATA-compatible external storage an easy option.

SCSI:
SCSI stands for “Small Computer System Interface”, and is a standard interface and command set for transferring data between devices on a computer bus. SCSI is pronounced “scuzzy” when spoken aloud, while occasional attempts to promulgate the more flattering pronunciation “sexy” have never succeeded. SCSI is most commonly used for hard disks and tape storage devices, but also connects a wide range of other devices, including scanners, CD-ROM drives, CD recorders, and DVD drives. In fact, the entire SCSI standard promotes device independence, which means that theoretically anything can be made SCSI (SCSI printers actually exist). In the past, SCSI was very popular on all kinds of computers. SCSI remains popular on high-performance workstations, servers, and high-end peripherals. Desktop computers and notebooks more typically use the ATA/IDE interfaces for hard disks and USB (which uses a subset of the SCSI command set for hard disks and floppy drives) for other devices.

As of 2003, there have only been three SCSI standards: SCSI-1, SCSI-2, and SCSI-3. All SCSI standards have been modular, defining various capabilities which manufacturers can include or not. Individual vendors and SCSITA have given names to specific combinations of capabilities. For example, the term “Ultra SCSI” is not defined anywhere in the standard, but is used to refer to SCSI implementations that signal at twice the rate of “Fast SCSI.” Such a signalling rate is not compliant with SCSI-2 but is one option allowed by SCSI-3. Similarly, no version of the standard requires low-voltage-differential (LVD) signalling, but products called Ultra-2 SCSI include this capability. This terminology is helpful to consumers, because “Ultra-2 SCSI” device has a better-defined set of capabilities than simply identifying it as “SCSI-3.”

Starting with SCSI-3, the SCSI standard has been maintained as a loose collection of standards, each defining a certain piece of the SCSI architecture, and bound together by the SCSI Architectural Model. This change divorces SCSI’s various interfaces from the command set, allowing devices that support SCSI commands to use any interface (including ones not otherwise specified by T10), and also allowing the interfaces that are defined by T10 to develop on their own terms. This change is also why there is no “SCSI-4”. No version of the standard has ever specified what kind of connector should be used. The connectors used by vendors have tended to evolve over time. Although SCSI-1 devices typically used bulky Blue Ribbon (“Centronics”) connectors, and SCSI-2 devices typically “Mini-D” connectors, it is not correct to refer to these as “SCSI-1” and “SCSI-2” connectors.

SCSI-1:
The original standard that was derived from SASI and formally adopted in 1986 by ANSI. SCSI-1 features an 8-bit bus (with parity), running asynchronously at 3.5 MB/s or 5 MB/s in synchronous mode, and a maximum bus cable length of 6 meters (just under 20 feet — compare that to the 18 inch (0.45 meter) limit of the ATA interface). A variation on the original standard included a high-voltage differential (HVD) implementation whose maximum cable length was many times that of the single-ended versions.

SCSI-2:
This standard was introduced in 1989 and gave rise to the Fast SCSI and Wide SCSI variants. Fast SCSI doubled the maximum transfer rate to 10 MB/s and Wide SCSI doubled the bus width to 16 bits on top of that (to reach 20 MB/s). However, these improvements came at the minor cost of a reduced maximum cable length to 3 meters. SCSI-2 also specified a 32-bit version of Wide SCSI, which used 2 16-bit cables per bus; this was largely ignored by SCSI device makers because it was expensive and unnecessary, and was officially retired in SCSI-3.

SCSI-3:
Before Adaptec and later SCSITA codified the terminology, the first parallel SCSI devices that exceeded the SCSI-2 capabilities were simply designated SCSI-3. These devices, also known as Ultra SCSI and fast-20 SCSI, were introduced in 1992. The bus speed doubled again to 20 MB/s for narrow (8 bit) systems and 40 MB/s for wide. The maximum cable length stayed at 3 meters but ultra SCSI developed an undeserved reputation for extreme sensitivity to cable length and condition (faulty cables, connectors or terminators were often to blame for instability problems).

UltraSCSI-2:
This standard was introduced c. 1997 and featured a low voltage differential (LVD) bus. For this reason ultra-2 is sometimes referred to as LVD SCSI. Using LVD technology, it became possible to allow a maximum bus cable length of 12 meters (almost 40 feet!), with much greater noise immunity. At the same time, the data transfer rate was increased to 80 MB/s. Ultra-2 SCSI actually had a relatively short lifespan, as it was soon superseded by ultra-3 (ultra-160) SCSI.

UltraSCSI-3:
Also known as Ultra-160 SCSI and introduced toward the end of 1999, this version was basically an improvement on the ultra-2 standard, in that the transfer rate was doubled once more to 160 MB/s by the use of double transition clocking. Ultra-160 SCSI offered new features like cyclic redundancy check (CRC), an error correcting process, and domain validation.

UltraSCSI-320:
This is the ultra-160 standard with the data transfer rate doubled to 320 MB/s. Nearly all new SCSI hard drives being manufactured at the time of this writing (October 2003) are actually ultra-320 devices.

UltraSCSI-640:
Ultra-640 (otherwise known as Fast-320) was promulgated as a standard (INCITS 367-2003 or SPI-5) in early 2003. Ultra-640 doubles the interface speed yet again, this time to 640 MB/s. Ultra640 pushes the limits of LVD signaling; the speed limits cable lengths drastically, making it impractical for more than one or two devices. Because of this, most manufacturers have skipped over Ultra640 and are developing for Serial Attached SCSI instead.

iSCSI:
iSCSI preserves the basic SCSI paradigm, especially the command set, almost unchanged. iSCSI advocates project the iSCSI standard, an embedding of SCSI-3 over TCP/IP, as displacing Fibre Channel in the long run, arguing that Ethernet data rates are currently increasing faster than data rates for Fibre Channel and similar disk-attachment technologies. iSCSI could thus address both the low-end and high-end markets with a single commodity-based technology.

Serial SCSI:
Three recent versions of SCSI SSA, FC-AL and Serial Attached SCSI break from the traditional parallel SCSI standards and perform data transfer via serial communications.

SCSI COMPATIBILITY ISSUES:
Note: Ultra-2, ultra-160 and ultra-320 devices may be freely mixed on the LVD bus with no compromise in performance, as the host adapter will negotiate the operating speed and bus management requirements for each device. Single-ended devices should not be attached to the LVD bus, as doing so will force all devices to run at the slower single-ended speed. Support for single-ended interfaces has been deprecated in the SPI-5 standard (which describes Ultra-640), so future devices may not be electrically backward compatible.

SCSI Caution note:
Modern Single Connector Attachment (SCA) devices may be connected to older controller/drive chains by using SCA adapters. Although these adapters often have auxiliary power connectors, use caution: it is possible to quickly destroy the drive by connecting external power. Always try the drive without auxiliary power first. SCSI devices are generally backward-compatible, i.e., it is possible to connect an ultra-3 SCSI hard disk to an ultra-2 SCSI controller and use it (though with reduced speed and feature set). Each SCSI device (including the computer’s host adapter) must be configured to have a unique SCSI ID on the bus. Also, the SCSI bus must be terminated with a terminator. Both active and passive terminators are in common use, with the active type much preferred (and required on LVD buses). Improper termination is a common problem with SCSI installations. It is possible to convert a wide bus to a narrow one, with wide devices closer to the adapter. To do this properly requires a cable which terminates the wide part of the bus. This is sometimes referred to as a cable with high-9 termination. Specific commands allow the host to determine the active width of the bus. This arrangement is discouraged.

SAS:
Serial Attached SCSI (SAS) is another computer bus technology primarily designed for transfer of data to and from devices like hard drives, CD-ROM drives and so on. SAS is a serial communication protocol for Direct Attached Storage (DAS) devices. It is designed for the corporate and enterprise market as a replacement for parallel SCSI, allowing for much higher speed data transfers than previously available, and is backwards-compatible with SATA drives. Though SAS uses serial communication instead of the parallel method found in traditional SCSI devices, it still uses SCSI commands for interacting with SAS End devices.

FB or Fiber Channel:
Fibre Channel is a gigabit-speed network technology primarily used for network storage. It is a very high speed bus that is used for NAS(Network Attached Storage). Fibre Channel is standardized in the T11 Technical Committee of the InterNational Committee for Information Technology Standards (INCITS), an American National Standards Institute–accredited standards committee. It started for use primarily in the supercomputer field, but has become the standard connection type for storage area networks in enterprise storage. Despite its name, Fibre Channel signaling can run on both twisted-pair copper wire and fiber optic cables. Fibre Channel Protocol (FCP) is the interface protocol of SCSI on the Fibre Channel.

OPTICAL DISC TYPES:
Read-only media (ROM):
DVD-ROM: These are pressed similarly to CDs. The reflective surface is silver or gold colored. They can be single-sided/single-layered, single-sided/double-layered, double-sided/single-layered, or double-sided/double-layered. As of 2004, new double-sided discs have become increasingly rare.
DVD-D: a new self-destructing disposable DVD format. Like the EZ-D, it is sold in an airtight package, and begins to destroy itself by oxidation after several hours.
DVD Plus: combines both DVD and CD technologies by providing the CD layer and a DVD layer. Not to be confused with the DVD+ formats below.
DVD-R for Authoring: a special-purpose DVD-R used to record DVD masters, which can then be duplicated to pressed DVDs by a duplication plant. They require a special DVD-R recorder, and are not often used nowadays since many duplicators can now accept ordinary DVD-R masters.
DVD-R (strictly DVD-R for General): can record up to 4.5 GB in a similar fashion to a CD-R disc. Once recorded and finalized it can be played by most DVD-ROM players.
DVD-RW: can record up to 4.7 GB in a similar fashion to a CD-RW disc.
DVD-R DL: a derivate of DVD-R that uses double-layer recordable discs to store up to 8.5 GB of data.
DVD-RAM (current specification is version 2.1): requires a special unit to play 4.7GB or 9.4GB recorded discs (DVD-RAM disc are typically housed in a cartridge). 2.6GB discs can be removed from their caddy and used in DVD-ROM drives. i Top capacity is 9.4GB (4.7GB/side)…

Recordable Media:
DVD+R: can record up to 4.7 GB single-layered/single-sided DVD+R disc, at up to 16x speed. Like DVD-R you can record only once.
DVD+RW: can record up to 4.7 GB at up to 16x speed. Since it is rewritable it can be overwritten several times. It does not need special “pre-pits” or finalization to be played in a DVD player.
DVD+R DL: a derivate of DVD+R that uses dual-layer recordable discs to store up to 8.5 GB of data. Dual Layer recording allows DVD-R and DVD+R discs to store significantly more data, up to 8.5 Gigabytes per disc, compared with 4.7 Gigabytes for single-layer discs. DVD-R DL (dual layer was developed for the DVD Forum by Pioneer Corporation, DVD+R DL (double layer — see figure) was developed for the DVD+RW Alliance by Philips and Mitsubishi Kagaku Media (MKM). A Dual Layer disc differs from its usual DVD counterpart by employing a second physical layer within the disc itself. The drive with Dual Layer capability accesses the second layer by shining the laser through the first semi-transparent layer. The layer change mechanism in some DVD players can show a noticeable pause, as long as two seconds by some accounts. More than a few viewers have worried that their dual layer discs were damaged or defective. DVD recordable discs supporting this technology are backward compatible with some existing DVD players and DVD-ROM drives. Many current DVD recorders support dual-layer technology, and the price point is comparable to that of single-layer drives, though the blank media remains significantly more expensive.

HD DVD: High Density DVD, or High-Definition DVD is a high-density optical disc format designed for the storage of data and high-definition video. HD DVD has a single-layer capacity of 15 GB and a dual-layer capacity of 30 GB. There is also a double-sided hybrid format which contains standard DVD-Video format video on one side, playable in regular DVD players, and HD DVD video on the other side for playback in high definition on HD DVD players. JVC has developed a similar hybrid disc for the Blu-ray format. These hybrid discs make retail marketing and shelf space management easier. This also removes some confusion from DVD buyers since they can now buy a disc compatible with any DVD/HD DVD player in their house. The HD DVD format also can be applied to current red laser DVDs in 5, 9, 15 and 18 GB capacities which offers a lower-cost option for distributors.

Blu-Ray
A Blu-ray Disc is a high-density optical disc format for the storage of digital media, including high-definition video. The name Blu-ray Disc is derived from the blue-violet laser used to read and write this type of disc. Because of this shorter wavelength (405 nm), substantially more data can be stored on a Blu-ray Disc than on the common DVD format, which uses a red, 650 nm laser. Blu-ray Disc can store 25 GB on each layer, as opposed to a DVD’s 4.7 GB. Several manufacturers have released single layer and dual layer (50 GB) recordable BDs and rewritable discs. Blu-ray Disc is similar to PDD, another optical disc format developed by Sony (which has been available since 2004) but offering higher data transfer speeds. PDD was not intended for home video use and was aimed at business data archiving and backup. Blu-ray Disc is currently in a format war with rival format HD DVD. About 9 hours of high-definition (HD) video can be stored on a 50 GB disc. About 23 hours of standard-definition (SD) video can be stored on a 50 GB disc. On average, a single-layer disc can hold a High Definition feature of 135 minutes using MPEG-2, with additional room for 2 hours of bonus material in standard definition quality. A double-layer disc will extend this number up to 3 hours in HD quality and 9 hours of SD bonus material.

Copyright 2010. All rights reserved for Data Recovery Lab, UK.