Page tree
Skip to end of metadata
Go to start of metadata

Overview

Internal hard drives became widespread in personal computers after 1983 and may employ hard disk drive (HDD) or solid state drive (SSD) technologies.  A computer may include multiple physical drives for additional file storage or backup; the primary drive will include not only content files, but operating systems, programs, and associated system files.  Discussions with the collecting units will help determine if it is necessary to image the entire drive or if it is appropriate to only copy select directories.

Internal hard drives are typically classified by type and size. The type is an indication of what connector cable is needed, and include IDE/PATA/ATA/EIDE, SATA, SCSI, and FibreChannel; common sizes are 2.5" for laptops and 3.5" for desktop computers.  Historically, the BDPL has most frequently encountered IDE/PATA (widely used from 1986-2003) and SATA (from 2003 onward) drives.  

  (3.5" SATA drive)


The SATA and IDE drives are easily distinguished by their connectors, with the latter featuring an array of pins.

 (SATA)


  (IDE)

(Images from https://www.reclaime.com/library/how-to-tell-ide-from-sata.aspx

Handling

When handling internal hard drives, staff should avoid dropping or exposing them to shocks.  It is especially important to avoid bumping or unplugging a drive while it is in operation. Electrostatic Discharge (ESD) is also a concern when removing a hard drive from a computer; while internal and external hard drive housings will protect against most ESD, touching a metal surface will also help discharge static electricity.

Internal hard drives should be transported in a box or enclosure to protect the drive from dust, shock, and other potential dangers.

Applying Barcode Labels

When applying barcode labels to a drive, avoid covering technical details on the drive label and never cover the drive's ventilation holes.  If available, staff may consider placing the label on a box or other enclosure housing the drive.

Write Protection

To ensure that information on the drive is not accidentally altered during the review and capture of content, always use write protection. 

Tableau T35u Forensic SATA/IDE Bridge

The Tableau T35u Forensic SATA/IDE Bridge can be used with both SATA and IDE interfaces (see picture of 3.5" SATA hard drive below):

To use:

  • Connect the drive to the Tableau T35u using the SATA or IDE data cable and drive power cable.  
  • Connect the T35u to the workstation using the blue USB cable.
  • Connect the power supply to the T35u and press the power button.
    • The lights on the right side of the forensic bridge will indicate the power, connection to the device and workstation, and indicate that write-blocking is activated.
    • The device will appear in the Windows File Manager.
    • When data on the device is read, the 'Activity' light will glow red.

Tableau T8u Forensic USB 3.0 Bridge

NOTE: the BDPL has found at least one case where an internal hard drive with an ext4 file system could not be recognized by the BDPL workstations.  In this case, the workaround was to use the Tableau T8u Forensic USB 3.0 Bridge in conjunction with an IDE/SATA to USB adaptor. 

<INSERT PHOTO OF SET UP>

To use:

  • Connect the drive to the IDE/SATA USB adaptor using the SATA or IDE data cable and drive power cable.  
  • Connect the ISE/SATA USB adaptor to the Tableai T8u.
  • Connect the T8u to the workstation with the blue USB cable.
  • Connect the DC power supply to the IDE/SATA USB adaptor.
  • Connect the DC power supply to the T8u and press the power button.
    • The lights on the right side of the forensic bridge will indicate the power, connection to the device and workstation, and indicate that write-blocking is activated.
    • The device will appear in the Windows File Manager.
    • When data on the device is read, the 'Activity' light will glow red.
  • No labels