±Forensic Focus Partners
|New Today: 0||Overall: 35279|
|New Yesterday: 3||Visitors: 146|
ForensicsBack to top Back to main Skip to menu
A variety of testing was performed by the author of this paper to understand the circumstances which would cause a modification to the Power_Cycle_Count and the Power_On_Hours SMART attribute values. A Knoppix  boot CD was used to boot the author's computer to perform these tests. The ultimate goal was to devise a forensic duplication process which would minimise the modification of these SMART attribute values. Detailed test results and the testing procedures are omitted from this paper for the sake of brevity.
The following hard disks were tested:
Â· Quantum Fireball Plus KX 20.5GB, model number QUANTUM FIREBALLP KX20.5, ATA Version 4, ATA Standard ATA/ATAPI-4 T13 1153D revision 15, Firmware Version A1S.3700
Â· Seagate Barracuda ATA III 40GB, model number ST340824A, ATA Version 4, ATA Standard Unknown, Firmware Version 3.05
Â· Western Digital Caviar 45GB, model number WDC WD450AA-00BAA0, ATA Version 4, ATA Standard Unknown, Firmware Version 10.09K11
Â· IBM Deskstar 41GB, model number IC35L040AVER07-0, ATA Version 5, ATA Standard ATA/ATAPI-5 T13 1321D revision 1, Firmware Version ER4OA44A
Â· Seagate Barracuda 120GB, model number ST3120026A, ATA Version 6, ATA Standard ATA/ATAPI-6 T13 1410D revision 2, Firmware Version 8.54
Â· Western Digital Caviar SE 160GB, model number WDC WD1600JB-00GVA0, ATA Version 6, ATA Standard Unknown, Firmware Version 08.02D08
The following hard disks were briefly tested, but were quickly rejected and excluded from the tests since they did not support SMART, which first appeared in the ATA Version 3 specifications:
Â· Conner Peripherals 425MB, model number CFS425A, ATA Version 1, ATA Standard Unknown, Firmware Version 0.23.
Â· Seagate Medalist 2113MB, model number ST32140A, ATA Version 1, ATA Standard Unknown, Firmware Version 08.08.01.