FORENSIC IMAGING NEWSLETTER

ISSUE:No. 5-1___________________________________________________________ January 6, 1997

STORAGE OPTIONS UPDATE

As we mentioned in our newsletter of February-96, the availability of Storage can become

an issue even though the size of the hard disc drives in our computers has become enormous

compared to what was the norm a few years ago. At IBIS we routinely install two hard drives in

our systems each with a capacity of 2-3 GIGABYTES, and even one 4 Gigabyte drive is not

uncommon. (We will expound on this design aspect in the next issue). If you routinely work on a

PC there usually comes a point where the hard drive just doesn't hold any more data,

particularly if Imaging is involved. The difference between an Imaging Computer and a run-of-

the-mill office type computer system is the size of the files: a prime example would be a ten-

print card "image" which is typically 16 Megabytes! When we run out of space on the hard disk,

we are forced to clean off "unnecessary" files by either deleting them totally or by putting the

seldom used files on some type of "BACKUP". Tape has been around for years but it's such a

pain to use, that many people would just as soon not use it even though it's right there on the

computer. So, what are the options? Fortunately,(or unfortunately if you are trying to decide on

a type of backup system to purchase), there are many ways to copy/move data from a hard

disk to removable media. Worm, Magneto-optical, and Multi-function optical drives; Recordable

(and soon Rewritable) CD-ROMs, and of course, tape drives and even tape jukeboxes!

CD-ROM TECHNOLOGY A CD-ROM is a convenient and inexpensive method of storing a

LARGE amount of data (currently 650 MB). CD-ROMS, born out of CD-Audio specifications,

have recently gone from a basic 4X speed to 12X. How does this type of technology work?

Consider a CD-ROM disc as having a continuous spiral track that is 4.5 miles long. You can

record a lot of data on 4.5 miles of track, 650 MB to be precise. So, how does one locate where

a particular file or directory begins and ends. Magnetic disks and most optical storage discs

have physical sectors (which CD's do not)where one can record data in easily located clusters.

Virtually since the time that CD's were invented, efforts to develop tools and techniques that

make CD recording as easy and manageable as hard disks have been focused on solving this

problem. Until quite recently, the only way to write data on recordable CD's was by a process

called "disc at once". One had to record a continuous stream in one pass until either the data

was completely recorded or the disc was full! see newsletter Feb.1995 for more on the history

of CD's.

THE NEXT ADVANCEMENT: IF we could stop the "writing" laser without finalizing a disc's

table of contents (TOC), write temporary directories of track and file information as data blocks ,

and then mark our place on the disc so that we could start again later, we would have Multi-

Session CD recording. Software device drivers in the premastering program, in conjunction with

required circuitry in Multisession-capable recorders enable us to do that today. The

premastering program can read the interim directory of previously recorded sessions, bring

required data files into cache buffers, modify them, store any changes, and record any new files

in the current session. When all sessions are complete, a formal ISO 9660 TOC is built and

finalized. Prior to finalizing, each session on the CD is like a separate CD with its own TOC.

Finalizing makes all the sessions look like a standard session for the whole disc. If you made it

this far, you probably wonder why this is so complicated. Remember that a CD is platform

independent, meaning that you are able to take a CD from a Mac to a PC running DOS or

Windows, and even to a UNIX based system!! If you create a Multisession CD, can your

existing CD-ROM read it? The latest CD-ROMS drives are multisession compatible, about one

third of the approximate 100 million drives that have been sold. So, unless you still own one of

the original 1X or 2X drives, the answer is probably -YES!

A NEW StANDARD: Multisession was still not considered to be the ideal solution, so, a new

specification was created, ISO 13490. This new ISO specification provides for an appendable

file system that requires specific device drivers to enable incremental packet writing, but only on

specific recorders. With ISO 9660, if a file is changed, the entire file directory structure has to

be rewritten. However, with ISO 13490, directory files are pertinent to only the packets being

written. A master structure called a path table lists the location of all directories on the disc. If a

file is changed, only the directory for the changed file and a new path need to be written. With

packet writing the user can add, delete, or modify files in the cache buffer and write the results

to the CD. No CD reader can read the information until the disc has been finalized in either the

13490 format, or software permitting, in the 9660 format. So, while the "perfect" method of

recording a CD has been invented, it has yet to be widely implemented. The CD-Rewritable

format, or CD-Erasable, has been under development since May of 1995. While many people,

myself included, thought that the DVD (digital video disc) technology would be available before

the end of 1996, DVD has been delayed again. While CD-Rewritable will be limited to the

current 650(680)MB capability as opposed to the 4.7GB-17GB of DVD, CD-RW is unique in that

it can read a CD; read and write CD-Recordable media; and read, write and overwrite CD-RW

discs!! With a CD-RW drive, a user could create discs that play on all CD players AND on

DVD-ROM drives(when they become available)! So, while CD-RW does not compare in speed

to Rewritable (MO) drives, or to ZIP/JAZ drives, they do offer a lot of compatibility for the future.

Manufacturers must cope with the evolving technology and try to determine what the market

wants, i.e. what YOU, will buy.

INTERESTING VARIATIONS: What's perhaps more interesting than just buying a faster

CD drive every year is the ability to have multiple CD's in a drive as in the case of NEC's 4X4

drive which holds 4 CD's in a single half height drive slot, or the product that Panasonic has just

released, a 10X speed drive which holds five (5) CD's!! Another interesting product is the

combination of a 4X CD-ROM reader with a Rewritable optical disk. For the Rewritable optical,

phase change technology is employed. Under phase change, the recording head directs a tiny

multiple energy laser across the disc. Because the surface of the disc has a different reflective

characteristic when heated, the drive head can read the difference states of reflectance as ones

and zeroes. To write over existing data, the laser heats the spot on the disc to its melting point,

eliminating the information. Simple, huh ??

OPTICAL DRIVES In 1993, the storage capacity of Rewritable 5.25 inch optical drives

doubled from 650 MB to 1.3GB. In May of 1996 the size doubled again, and it is predicted that

within two years it will double again! Pinnacle Micro is a company perhaps best known for its

CD-R, or recordable CD-ROM units. However, Pinnacle Micro also manufactures a line of

optical storage products. Their initial product, the Vertex, held 2.6 Gigabytes of data on a

removable cartridge. Recently they introduced the APEX, which ups the ante to 4.6 gigabytes

while maintaining the ISO standard which allows the cartridges to be read by other manufactors

4.6 GB drives!

David E. Barnes Ph.D.