Chapter 3 — Exercises

Thirty problems in seven groups (A–G), mixing concept checks, anatomy recall, RAID arithmetic, read-only triage labs ("identify this medium," "reconstruct this array," "calculate and verify the parity," "write the intake sheet"), and judgment calls. The single reflex this chapter builds — answer "what am I holding, and how healthy is it?" before you touch a tool — is exercised here from every angle. (answer in Appendix) marks problems with a full worked solution in Answers to Selected Exercises. ⭐ marks a stretch problem that pushes past the chapter. Keep your written work; the triage sheet from Group G becomes page one of your Forensic Case File.

Group A — The first question on the bench: identify the medium

3.1 A drive arrives with the label WD10SPZX-21Z10T0, 2.5-inch form factor, SATA connector. A second arrives marked Samsung SSD 870 EVO 1TB. A third is a fingernail-sized card marked microSDXC 256GB. For each: (a) classify it as HDD, SSD, or flash media; (b) state the single most important consequence of that classification for whether deleted data still survives; and (c) name one piece of evidence — from the label, the interface, or a read-only query — you would use to confirm your classification rather than guess. (answer in Appendix)

3.2 You run lsblk -d -o NAME,ROTA,SIZE,TRAN,MODEL and one device shows ROTA = 1 while another shows ROTA = 0. (a) What does the ROTA column report, and which value means a spinning disk? (b) Which hdparm -I line independently confirms the same thing, and what exact text does it print for an SSD? (c) The TRAN column reports sata for one device and nvme for another — explain what that interface tells you about the device and why an NVMe device is necessarily solid-state. (d) Why is it worth confirming "rotational or solid-state" two different ways before you build a recovery plan around the answer, and what enclosure trick (a USB-to-SATA bridge) can make a single query lie about the transport?

3.3 ⭐ (Judgment.) Two clients call on the same morning. Both say: "I reformatted my drive by mistake yesterday — can you get my files back?" Client A's device is a 3.5-inch SATA hard drive; Client B's is an M.2 NVMe SSD in an ultrabook. (a) Explain why your honest prognosis for these two identical-sounding problems is wildly different. (b) Name the specific mechanism that collapses Client B's recovery window. (c) Explain why quoting either client a price or a confidence level before identifying the medium is unprofessional. (Compare the two outcomes worked in Chapter 2's case studies.)

Group B — The hard disk drive: anatomy and failure

3.4 Name and give the one-line function of each labeled part of a hard drive: (a) platter, (b) read/write head, (c) actuator arm and voice coil motor, (d) spindle motor, (e) PCB, and (f) the service area (System Area). For (f), additionally name two things stored there and explain why their corruption can make a drive report zero capacity even though every byte of user data is intact on the platters. (answer in Appendix)

3.5 A drive spins up but reports a garbage model string and a capacity of 0 LBA; another won't spin at all and emits a faint buzz; a third spins up and produces a rhythmic click… click… click. (a) Map each symptom to its most likely failure mode (firmware/service-area corruption, motor seizure/stiction, head crash). (b) For the clicking drive, explain precisely why every additional power-cycle subtracts from what is recoverable, tying your answer to the War Story's "every spin-up is a withdrawal from an account you cannot refill." (c) Which of the three is a logical problem and which two are physical, requiring a clean-room lab (Chapter 8)? (d) A client tells you a forum advised "put it in the freezer overnight, then it'll work long enough to copy the files." Explain why this folklore belongs to a dead era of drives and what it does to a drive with crashing heads.

3.6 Bad sectors leave a paper trail in SMART. (a) Name the SMART attribute (by number and name) that counts sectors failing to read right now, and the one that counts sectors already swapped out for spares. (b) Explain the lifecycle by which a "current pending" sector becomes a "reallocated" one, and which on-drive defect list records it. (c) A drive shows 6 reallocated sectors and 0 pending; another shows 1,184 reallocated and 312 pending. Which is "normal aging" and which is "image it once, now, gently," and why?

3.7 ⭐ A technician has a dead drive whose PCB shows a visibly burned chip, and an identical donor drive of the same model. (a) Explain why simply unbolting the donor's PCB and bolting it onto the patient will probably not work on a drive made in the last fifteen years. (b) Name the specific component that must be transferred from the original board, and what it holds. (c) Describe the failure you risk if you ignore this and the drive mis-calibrates. (d) Which SMART/diagnostic clue at intake would have told you the failure was electrical (PCB) rather than mechanical (heads)?

3.8 Compare PMR and SMR recording. (a) In one sentence each, how does each lay tracks on the platter? (b) Why can SMR not rewrite a single track in place, and what larger unit must it rewrite instead? (c) Give one way SMR's background reorganization complicates recovery (think: does the physical location of your data stay put?) and one way it complicates imaging a failing drive. (d) Drive-managed SMR (DM-SMR) hides the band-rewrite behavior behind firmware using a persistent cache; explain why this makes a cheap SMR drive's write performance unpredictable, and why "the drive went busy for a long time during a large copy" is a clue you might be holding one.

Group C — The solid-state drive: NAND and the FTL

3.9 Reproduce and reason about the bits-per-cell ladder. (a) For SLC, MLC, TLC, and QLC, state bits per cell and the number of distinguishable voltage states (2, 4, 8, 16). (b) Explain, using the "the windows get narrower" argument, why QLC wears out in far fewer program/erase cycles and reads more slowly than SLC. (c) Name the two manufacturing/firmware techniques drives use to claw back endurance and speed from dense NAND. (answer in Appendix)

3.10 State NAND's "critical asymmetry." (a) Name the unit you can read or program and the (larger) unit you can only erase. (b) Explain why a page already holding data cannot be overwritten in place, and describe exactly what the controller does instead when the host "changes" 4 KB of a file. (c) Explain in one sentence why this single fact is the root cause of wear leveling, garbage collection, and the FTL.

3.11 The Flash Translation Layer is "the great abstraction and the great obstacle." (a) List four jobs the FTL performs. (b) Explain why losing or corrupting the FTL's logical-to-physical mapping table turns the raw NAND into "a jigsaw with no picture on the box." (c) Explain why this is exactly why naive "chip-off" recovery — desolder the NAND and dump every page — usually fails on a modern SSD even when every page reads perfectly. (d) Define over-provisioning and write amplification, and explain how each is a direct consequence of the FTL coping with NAND's erase-before-write nature. (e) "Static" wear leveling can physically relocate a file you have not touched in years; explain why, and what that implies about the claim "this data hasn't moved since I saved it."

3.12 ⭐ Map each SSD symptom to its failure mode and say what it means for recovery: (a) the drive vanishes from the system and reports 0 MB after a power event; (b) the drive has dropped into a permanent read-only state with climbing program-fail counters; (c) after an unexpected outage the drive reports wrong capacity or hangs; (d) a fleet of identical enterprise SSDs all brick at the same power-on-hours count. For (b), explain why a read-only SSD is, counter-intuitively, good news — and what you must do immediately.

3.13 Read this NVMe health log and triage the drive:

percentage_used            : 7%
available_spare            : 100%
available_spare_threshold  : 10%
media_errors               : 0
unsafe_shutdowns           : 9

(a) What does percentage_used measure, and can it exceed 100%? (b) What does available_spare falling toward its threshold tell you? (c) unsafe_shutdowns is 9 — why does that number matter specifically for a consumer drive without power-loss-protection capacitors, and what does each one risk corrupting?

Group D — Flash media: USB drives, SD cards, monoliths

3.14 Distinguish standard from monolithic flash construction. (a) Physically, what is different inside the package? (b) Why is the standard construction far more recoverable when the controller dies — what can a lab physically do that it cannot do to a monolith? (c) State which of these are essentially always monolithic: microSD cards, modern USB sticks, older bulky USB sticks. (d) Even after a lab reads the raw NAND off a monolith via test points, what unsolved problem remains before the files appear? (answer in Appendix)

3.15 Two cheap-flash failure modes belong in your reflexes. (a) Describe fake-capacity / counterfeit media: what the controller is reprogrammed to do, and what physically happens when you write past the real NAND. Name a tool that detects it by writing and reading back. (b) A USB stick's metal connector has snapped off and it is "dead." Explain why this is often not a data-loss event, and what a lab assesses before declaring the data lost.

3.16 ⭐ The eMMC and UFS chips soldered inside phones, tablets, and IoT devices are flash with an FTL, just like an SSD. (a) Name the two physical acquisition techniques used to read them when normal access fails, and what each involves (test points vs. desoldering). (b) Explain why these techniques anchor the mobile chapters (Ch.11 recovery, Ch.24 forensics) rather than the desktop ones. (c) Why does on-chip encryption make a successful raw NAND dump from a modern phone far less useful than the same dump from a 2012 phone?

Group E — RAID: how it stores and how it dies

3.17 Complete this table for a five-disk array of 4 TB disks (assume identical disks; ignore filesystem overhead):

For each, give the usable capacity in TB, the guaranteed number of simultaneous disk failures it survives, and the minimum disk count for that level. Then state which level is fastest with no protection and which gives the cleanest, fastest rebuild. (answer in Appendix)

3.18 RAID 5 parity is "just XOR." A three-disk stripe holds one byte per disk; disk 2 has failed. The survivors are Disk 1 = 0x6D and the parity block = 0x2C. (a) Reconstruct the missing byte from Disk 2 by XOR-ing the survivors; show the work in binary and give the answer in hex and as its ASCII character. (b) State the property of XOR (P = D1 ⊕ D2 ⊕ D3 ⊕ …) that makes this work for any one missing term. (c) Verify your answer by XOR-ing all three reconstructed bytes together — what value must you get, and why? (answer in Appendix)

3.19 "RAID 5 has fallen out of favor for large arrays." (a) Explain the rebuild trap: what the controller must read across every surviving disk when you replace a failed member, and why that is a brutal stress test. (b) Define an unrecoverable read error (URE) and explain why hitting one during a rebuild is catastrophic for a single-parity array. (c) Explain in one sentence why bigger disks make this worse, and which level (§ RAID 6) was designed to close the gap. (d) Separately, describe the RAID 5 write hole: what is left inconsistent if power is lost mid-stripe-write, why a later rebuild can then silently produce wrong bytes, and what two mechanisms (battery-backed cache, journaling) mitigate it.

3.20 ⭐ (Judgment.) For each scenario, state whether the array survives and recovers, or is lost: (a) RAID 5 of 4 disks, one disk dies, replaced and rebuilt cleanly; (b) RAID 5 of 4 disks, two disks drop within the same hour; (c) RAID 6 of 6 disks, two disks die during a rebuild of a third; (d) RAID 10 of 4 disks (two mirror pairs), one disk fails in each pair; (e) RAID 10 of 4 disks, both disks of one pair fail. For (e), explain why "RAID 10 survives multiple failures" is true in general but false here.

3.21 A controller has died and you must reconstruct a RAID 5 from a pile of member disks. (a) List the five geometry parameters you must recover before the volume will mount. (b) Match each RAID metadata signature to its implementation: 0xa92b4efc, 0xDE11DE11, Intel Raid ISM Cfg Sig.. (c) When no metadata survives, name two things you search the member images for to reverse-engineer the parameters by hand, and explain how entropy analysis helps you spot the parity blocks. (d) You find the Linux md magic stored on disk as the bytes FC 4E 2B A9. Show how those four bytes correspond to the magic number 0xa92b4efc, and state what that byte order tells you about how md stores multi-byte values.

Group F — Network storage and read-only triage

3.22 Distinguish a NAS from a SAN. (a) Which serves files and which serves blocks? (b) Name one access protocol for each (e.g., SMB/NFS vs. iSCSI/Fibre Channel). (c) On a SAN, what is the unit the connected server sees and formats as if it were a local disk, and what is therefore the unit of both recovery and evidence? (d) A junior colleague says "the cloud is fundamentally different from all of this." Push back: explain why "the cloud" is, at the storage layer, just someone else's HDDs, SSDs, and SANs, and what actually makes cloud recovery and forensics a different discipline (hint: it is not the media). Point them to Chapter 31.

3.23 You must recover data from a four-bay Synology NAS that won't boot. (a) Explain why you do not recover it through its own web interface, and what you do instead with the physical disks. (b) List, in order, the layers you must reconstruct offline (RAID → ?? → file system). (c) What is the danger of letting the NAS "repair itself" on boot before you have imaged the disks? (d) Why does a copy-on-write file system like Btrfs or ZFS on that NAS often help you, recovering older versions of changed or deleted files? (Cross-ref Chapter 4.) (e) Synology's SHR is described as "mdadm plus LVM that allows mixed disk sizes." Explain why mixed-size disks make the geometry harder to reverse than a uniform array, and why you must still image every member, including any that look healthy.

3.24 ⭐ (Legal/scope.) You are authorized to image one tenant's data on a multi-tenant SAN that also hosts unrelated organizations' LUNs on the same hardware. (a) Why can you almost never attach a write-blocker and image the whole array? (b) Explain the dual problem — evidentiary and ethical — created if you image LUNs outside your scope. (c) Describe how you would identify and isolate only the in-scope LUNs, and what you document about the isolation. (The legal machinery is developed in Chapter 25.)

Group G — Hands-on labs and the Progressive Project

3.25 (Lab — triage your own drives, read-only.) On your own machine (never on evidence): (a) run lsblk -d -o NAME,ROTA,SIZE,TRAN,MODEL (Linux/macOS via diskutil list, Windows via Get-PhysicalDisk) and classify every drive as HDD or SSD; (b) pull SMART data with smartctl -a (or nvme smart-log, or Get-StorageReliabilityCounter) and record, for each HDD, the reallocated and pending sector counts, and for each SSD, the wear/percentage-used and unsafe-shutdown counts; (c) write one sentence per drive stating whether it is mechanically sound, aging, or failing. Keep the output — it is your reference for what healthy looks like. A fuller command reference lives in Appendix H. (answer in Appendix)

3.26 (Lab — reconstruct this array.) Using the practice RAID member images from Appendix J (or build your own: create three small files, stripe them by hand into a RAID 5 layout with one parity block per stripe): (a) determine the disk order and stripe size; (b) reconstruct the array virtually, read-only — never write to the members; (c) confirm success by mounting (or carving) the reassembled volume and finding a known file. (d) In your notes, state which single wrong parameter (order, stripe size, or parity rotation) you would expect to produce a volume that almost mounts but yields corrupt files, and why. (e) Document each parameter you settled on and how you confirmed it — a clean file-system mount, a known file opening correctly — so the reconstruction reads as a repeatable analysis step rather than a lucky guess, the standard a court would expect.

3.27 (Lab — calculate and verify the parity.) Take three equal-length byte strings to stand in for a RAID 5 stripe's data blocks D1, D2, D3. (a) Compute the parity P = D1 ⊕ D2 ⊕ D3 by hand or with the reconstruct_raid5_block function from the chapter. (b) Now "fail" D2: reconstruct it from D1, D3, and P, and confirm it matches the original bit-for-bit. (c) Explain what this proves about why a single-parity array survives exactly one disk and no more. (d) Now "fail" two blocks at once (D2 and D3) and try to reconstruct: show that with only D1 and P you cannot recover either, and explain in one line why this is precisely the RAID 5 double-fault limit from Case Study 1. (e) Why must this operation, in a real recovery, run over forensic images of the members and never the original disks?

3.28 (Lab — write the intake report.) A 1 TB 2.5-inch SATA drive arrives, model decodes to a conventional HDD, SMART shows 6 reallocated / 0 pending sectors and 19,000 power-on hours, no clicking. (a) Write the weak intake note ("got a drive, looks okay"). (b) Rewrite it as a court-grade intake record capturing identity (make/model/serial/capacity/interface), media classification with the evidence for the call, the health read, the recoverability posture (logical vs. physical fault), and any TRIM/encryption concerns. (c) State what specifically makes the second version part of a defensible chain of custody. (Templates: Appendix F.)

3.29 ⭐ (Progressive Project — characterize the evidence device.) For the device you will carry through the book (a practice image's source profile or a spare drive of your own), produce the one-page Device Identification & Triage sheet described in the chapter: physical description and identity; media classification with evidence; health triage (the right SMART/health attributes for the medium); recoverability posture; and — if RAID/NAS — the array level, member count, your best estimate of disk order and stripe size, and the metadata format you found. Date it and sign it. This sheet is page one of the case file you formalize in Chapter 5.

3.30 ⭐ (Synthesis / knowing when to stop.) For each, state whether the data is genuinely, permanently gone, and name the mechanism: (a) a hard-drive platter region physically scored by a head crash; (b) a TRIM-enabled SSD's deleted file, examined a week later, after garbage collection ran; (c) an SSD whose controller issued a cryptographic erase (discarded its internal AES key); (d) a RAID 6 that lost three disks; (e) a worn consumer SSD left unpowered in an evidence drawer for two years. Then write the honest one-sentence finding you would give a client (or a court) for case (b), per theme #5 — know your limitations.

Self-check. You have mastered this chapter when you can pick up any storage device and, within a minute, classify it correctly and justify the call; name the parts and the failure modes of an HDD and an SSD and match each failure to its intake symptom; explain NAND's page/block asymmetry and why the FTL makes SSD recovery hard; reconstruct a RAID 5 byte with XOR on paper and recite the five geometry parameters a reassembly needs; and — most importantly — state, for any medium, the conditions under which the data is truly gone. If the RAID arithmetic in Group E still feels slow, drill 3.17–3.21 until the capacity, fault-tolerance, and XOR facts are automatic; the recovery chapters of Part II (Ch.8–Ch.10) assume them. Next, move up one layer to how those raw sectors become files and directories in Chapter 4 — File Systems.