Digital Evidence · Topic 1 of 8
Digital Evidence and Disk Storage
Learn the types, characteristics and sources of digital evidence, plus HDD and SSD structure, MBR and GPT, RAID, NAS and SAN, and disk interfaces for CHFI.
- 6 min
- Volatile evidence is collected first, following the order of volatility.
- MBR: 446 bytes code, 64 bytes partition table, signature 55 AA. GPT header is at LBA 1 with signature EFI PART.
- RAID 5 needs three disks and survives one failure. RAID 6 survives two. RAID 0 has no redundancy.
What it is
Digital evidence is any information stored or transmitted in digital form that can support or refute a fact in an investigation. The investigator must know what kinds exist, where they come from, and how the media that holds them is built, because the structure decides what can be recovered.
The exam asks you to classify evidence, name its properties, and recognize disk structures such as MBR, GPT and RAID levels.
How it works
Types and characteristics
| Type | Examples | Note |
|---|---|---|
| Volatile | RAM, running processes, network connections, clipboard | Lost at power off. Collect first. |
| Non volatile | Files on disk, logs, registry, email stores | Survives power off |
| Network based | Packet captures, flow records, firewall and proxy logs | May exist only for a short time |
Digital evidence is latent (it cannot be seen without tools), fragile, easy to copy exactly, and time sensitive. It is often circumstantial, so it supports a conclusion through other facts. It can be altered without a trace if handled carelessly.
EC-Council lists five rules for good evidence: it must be admissible, authentic, complete, reliable and believable. The best evidence rule favors the original, but a verified bit-for-bit copy is generally accepted as equivalent for electronic data.
The order of volatility guides collection: registers and cache, RAM, network state, running processes, disk, remote logs, archival media.
Sources of evidence
Computers, laptops, servers, mobile phones, tablets, removable media, cameras, smart cards, printers, wearables, IoT devices, cloud accounts, network devices, CCTV and access control systems all hold potential evidence.
Hard disks and SSDs
A hard disk stores data on spinning platters read by heads on an actuator arm. Data is organized in tracks, sectors (traditionally 512 bytes, 4,096 bytes on Advanced Format drives) and clusters (groups of sectors, the file system allocation unit).
An SSD stores data in NAND flash managed by a controller. Three features matter to an investigator.
| SSD feature | Effect on evidence |
|---|---|
| Wear leveling | Spreads writes, so logical and physical locations differ |
| TRIM | Tells the drive which blocks are free, so deleted data may be erased early |
| Garbage collection | Can run in the background, even on a drive attached through a write blocker |
Overwrite based wiping is unreliable on SSDs, and deleted data is less likely to be recoverable than on a hard disk.
Logical structure of disks
| Item | MBR | GPT |
|---|---|---|
| Location | First sector (LBA 0), 512 bytes | Protective MBR at LBA 0, header at LBA 1 |
| Layout | 446 bytes boot code, 64 bytes partition table (four 16 byte entries), 2 byte signature 55 AA | Header signature EFI PART, then partition entries (typically 128 entries of 128 bytes) |
| Partitions | Four primary, or three plus one extended | Up to 128 by default |
| Size limit | About 2 TiB with 512 byte sectors | Far beyond 2 TiB |
| Resilience | One copy | Backup header and table at the end of the disk, CRC32 checks |
Unused space also holds evidence: unallocated space, file slack (the gap between the end of a file and the end of its last cluster), and volume slack (space between partitions or after the last one).
RAID
| Level | Method | Minimum disks | Tolerates |
|---|---|---|---|
| RAID 0 | Striping | 2 | No failure |
| RAID 1 | Mirroring | 2 | One disk |
| RAID 5 | Striping with distributed parity | 3 | One disk |
| RAID 6 | Striping with double parity | 4 | Two disks |
| RAID 10 | Mirrored pairs, then striped | 4 | One per pair |
Acquiring a RAID set means recording the controller type, stripe size and disk order. Imaging the array as one logical volume is often simpler than imaging each member, but members imaged individually can be reassembled later with the right parameters.
RAID and virtualization, NAS and SAN
A virtual machine's disk is a file such as VMDK, VHD, VHDX or VDI, often stored on a RAID datastore. Snapshots and memory files (such as a VMEM file) hold earlier states. Investigators copy these files, or snapshot the VM, rather than imaging the physical array.
| Storage | Access | Protocols |
|---|---|---|
| NAS | File level over the network | SMB/CIFS, NFS |
| SAN | Block level, appears as a local disk | Fiber Channel, iSCSI |
Servers on NAS or SAN usually cannot be powered down, so acquisition is live: use the vendor's tools or image the logical unit number (LUN) through a host.
Disk interfaces
IDE/PATA, SATA, SCSI, SAS, USB, FireWire (IEEE 1394), Thunderbolt and NVMe (over PCIe, often in M.2 form) are the common interfaces. A write blocker must match the interface of the suspect drive. NVMe drives need a blocker built for NVMe.
A worked example
A server holds four disks in RAID 5. One disk has failed. The investigator records the controller model and stripe size, images the three working disks and the array, and notes the disk order.
Because RAID 5 tolerates one failed disk, the data is still intact. The images are hashed and the hash recorded before any analysis.
How the exam asks about this
- "Which type of evidence is lost when a system is powered off?" → Volatile evidence, such as RAM.
- "Where is the partition table in an MBR disk?" → In the first sector, after 446 bytes of boot code.
- "Which storage type gives block level access over Fiber Channel or iSCSI?" → SAN.
What to remember for the exam
- Volatile evidence is collected first, following the order of volatility.
- MBR: 446 bytes code, 64 bytes partition table, signature 55 AA. GPT header is at LBA 1 with signature EFI PART.
- RAID 5 needs three disks and survives one failure. RAID 6 survives two. RAID 0 has no redundancy.
- NAS is file level, SAN is block level.
- TRIM and garbage collection can destroy deleted data on SSDs.
Garbage collection can change an SSD while it is connected, even behind a write blocker, so a hash taken on a later read may not match the first one.
Common mistakes
Calling RAID a backup. RAID protects against disk failure, not deletion or corruption. A deleted file is removed from every member.
Assuming a write blocker stops all change on an SSD. It blocks writes from the host, but internal housekeeping continues.
Mixing up slack types. File slack is inside the last cluster of a file. Volume slack is outside any partition.
Check yourself
How large is an MBR and what does it contain?
512 bytes: 446 bytes of boot code, a 64 byte partition table and a 2 byte signature.
Which RAID level uses distributed parity and tolerates one disk failure?
RAID 5, which needs at least three disks.
Why is deleted data harder to recover from an SSD?
TRIM and garbage collection erase unused blocks, and wear leveling hides physical locations.
Topic 1 of 8 in Digital Evidence
Test yourself on Digital Evidence
The full EC-Council 312-49 question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.