[ale] Hard disks for a living [Was: Re: external hard drive]

Wed Jan 27 11:21:09 EST 2010

Scott,

We do a ton with disk drives as well, but we focus on forensic
analysis of them and of course the data on them.  Imaging (dd clones
if you will), Wiping, data recovery, etc.

As a matter of fact, just yesterday I proposed to the ICE Summit to do
a presentation about emerging storage technology at their March event
(they only have a summit once a year).

http://www.icesummit.org/

The ICE Summit is held at Kennesaw college but draws from at least
half the country.  First year by that name.  It used to be the
CyberCrime Summit (iirc).  They've skipped a couple years for
political reasons, but now they are back.

I proposed talking about SSDs and rotating drives with 4K sectors
specifically.  Each has caveats a forensic examiner should be aware
of.

If we're lucky, Scott Mouton will give a presentation on the internals
of a disk drive.  I've never seen his talk, but he teaches a multi-day
class in Marietta / Kennesaw area (I assume) that covers true data
recovery including moving platters around (I think).  Everyone that
goes raves about how good it is.  (Scott M lives in NE Atlanta
somewhere.  Maybe Canton.).

Scott M has some great presentations at
<http://www.myharddrivedied.com/presentations.html>

If your at all intrigued by the ICE Summit, they normally give
speakers a free attendance pass for the whole event.  I'm not positive
they are doing that this year, but I assume so.  I don't know what you
planned to present to ALE, but likely the same topic would be
appropriate for the ICE Summit.

Greg

On Wed, Jan 27, 2010 at 10:16 AM, scott <scott at sboss.net> wrote:
> from someone that does storage (think disk drives) for a living..
> 1) disks fail.  not if, but when.
> 2) if you can hear disks making sounds, it is time to replace them.
>  a) if the disk is relatively new, have the manufacture replace the
> drive.  they have built that cost into the purchase price.
> 3) backup all important data.
>
> at some point aaron will have me do my preso on storage.. I just have
> to finish writing it up...
>
> scott
>
> On Wed, Jan 27, 2010 at 9:52 AM, Geoffrey Myers
> <lists at serioustechnology.com> wrote:
>> Robert Coggins wrote:
>>> Speaking of drives, I just bought a 500 gig portable drive that I will
>>> be mostly using with linux and mac.  Sometimes I might connect it to a
>>> windows box.  What is the best file system to use so that the drive
>>> works between all three?  Right now it is vfat but I am limited to 4 gig
>>> files.  I would like to keep some virtuals on it...
>>>
>>>
>>> Geoffrey, when I bought my new drive I had similar issues.  It was green
>>> drive but I went ahead and returned it for the same drive.  I no longer
>>> hear the noises.  But my noises might have been different; when I picked
>>> up the drive the sound would change depending on how I tilted it.  It
>>> still worked, but I returned it to get my comfort level up.
>>
>> Yeah, I think I'm going to do the same.
>>
>>>
>>> Rob
>>>
>>> On 01/27/2010 09:13 AM, Geoffrey Myers wrote:
>>>> Greg Freemyer wrote:
>>>>> Is it a green drive?
>>>>>
>>>>> Ie. To save power, by design it powers off after a few milliseconds of non-use?
>>>>>
>>>>> I have seen lots of discussion of the problems they have under linux,
>>>>> but I don't recall the details.
>>>>>
>>>>> Fyi: if you don't address the issue, the drive will die early if it is
>>>>> green drive.
>>>> Doesn't say anything about being a green drive that I can see on the
>>>> box.  Seagate FreeAgent Desk.  My daughter has the exact same drive
>>>> connected to her mac, never has such issues.
>>>>
>>>>> Greg
>>>>>
>>>>> On 1/27/10, Geoffrey Myers <lists at serioustechnology.com> wrote:
>>>>>> So, I picked up a 1.5 tb external drive.  I pushed a bunch of data off
>>>>>> to it all went well.  Later, I connect the drive up to a couple of
>>>>>> different boxes.  Each time, the drive is giving that really scary
>>>>>> clicking sound you dread.  I can access the data fine, I don't see any
>>>>>> errors being produced.  This thing is brand new, what is with this?  Any
>>>>>> reason anyone can come up with why this drive would be making these noises?
>>>>>>
>>>>>> --
>>>>>> Until later, Geoffrey
>>>>>>
>>>>>> "I predict future happiness for America if they can prevent
>>>>>> the government from wasting the labors of the people under
>>>>>> the pretense of taking care of them."
>>>>>> - Thomas Jefferson
>>>>>> _______________________________________________
>>>>>> Ale mailing list
>>>>>> Ale at ale.org
>>>>>> http://mail.ale.org/mailman/listinfo/ale
>>>>>> See JOBS, ANNOUNCE and SCHOOLS lists at
>>>>>> http://mail.ale.org/mailman/listinfo
>>>>>>
>>>>
>>> _______________________________________________
>>> Ale mailing list
>>> Ale at ale.org
>>> http://mail.ale.org/mailman/listinfo/ale
>>> See JOBS, ANNOUNCE and SCHOOLS lists at
>>> http://mail.ale.org/mailman/listinfo
>>>
>>
>>
>> --
>> Until later, Geoffrey
>>
>> "I predict future happiness for America if they can prevent
>> the government from wasting the labors of the people under
>> the pretense of taking care of them."
>> - Thomas Jefferson
>> _______________________________________________
>> Ale mailing list
>> Ale at ale.org
>> http://mail.ale.org/mailman/listinfo/ale
>> See JOBS, ANNOUNCE and SCHOOLS lists at
>> http://mail.ale.org/mailman/listinfo
>>
>
> _______________________________________________
> Ale mailing list
> Ale at ale.org
> http://mail.ale.org/mailman/listinfo/ale
> See JOBS, ANNOUNCE and SCHOOLS lists at
> http://mail.ale.org/mailman/listinfo
>

-- 
Greg Freemyer
Head of EDD Tape Extraction and Processing team
Litigation Triage Solutions Specialist
http://www.linkedin.com/in/gregfreemyer
Preservation and Forensic processing of Exchange Repositories White Paper -
<http://www.norcrossgroup.com/forms/whitepapers/tng_whitepaper_fpe.html>

The Norcross Group
The Intersection of Evidence & Technology
http://www.norcrossgroup.com