Storage Media
Storage Media
This domain tests how media store data and how technology affects acquisition and recovery. The examiner must distinguish magnetic, flash, optical, and tape behavior rather than treating all media as equivalent.
Core concepts
- Hard disk drives use platters, heads, and sectors, commonly 512 or 4096 bytes. Legacy CHS addressing is replaced by LBA. ATA drives may hide areas in an HPA or DCO; detect and document them.
- Partition schemes include MBR and GPT. Sector size reporting may be 512e or 4Kn, affecting alignment and tool interpretation.
- SSDs use flash with wear leveling, garbage collection, and TRIM. TRIM can make deleted content unrecoverable; over-provisioning and secure-erase commands also affect recovery.
- Hybrid and SMR drives have different write behavior. USB flash and SD cards use controllers that may remap blocks.
- Optical media use sessions and ISO images; tape is sequential and often needs specialized software.
Worked example
An SSD has TRIM enabled. A deleted file's directory entry remains, but its clusters have been trimmed and read as zeros. The examiner documents the TRIM state, explains why carving yields nothing, and does not claim the file never existed. The metadata proves prior existence; the content is unavailable.
Traps
Assuming SSDs behave like HDDs; ignoring HPA/DCO; confusing 512e with 4Kn; not checking SMART health; mounting evidence in the host OS; promising recovery from trimmed flash.
Key points
- HDD and SSD deletion behavior differs fundamentally.
- HPA and DCO can hide disk regions.
- TRIM and garbage collection limit SSD recovery.
- Partition scheme and sector size affect interpretation.
- Document media health, geometry, and hidden areas.