1

David P. PappasFabio da SilvaSean Halloran

Alexey NazarovNIST, Boulder, CO

Ken Marr, James RyanFBI Academy, Quantico, VA

Magnetic ForensicsThe Lost 18 ½ minutes of the Nixon Presidency

=> a magnetic microscopy study

NISTCompetence

Program

2Outline

• Development of magnetic sensors

– Hard disk drives

• Cassette & DAT Tape

• How data is stored on tapes

• Analysis of magnetic tapes

– Authenticity

– Data recovery

• Studies of magnetic tapes

– NARA test tapes for Nixon 18 ½ minute gap

• Development of high resolution real-time imaging system

• Outlook for data-recovery using high resolution imaging

3Intense development of magnetic sensors has

enabled high density hard disk drive (hdd) storage

Thomas N. Theis and Paul M. Horn, Phys. Today, July 2003

4Improvements in areal density

Magneto-Resistive

Read Elements

Small,sensitive

Error codecorrection

Smallbits

Mechanicalactuators,interface

Write

heads Smaller, stronger

Heads

MediaHigh

stability

Commercial technology at ~ 100 Gbit/in2, demos ~ 300

• Currently limited by field strengths of write heads

• Enabled by the existence of magneto-resistive read elements

5What is a Magneto-Resistor?

• Thin film resistor made with magnetic material (NiFe, Co)

Magnetization (M)

B-field

Resistance:

R for M|| > R for M┴Ohm Meter

1890 - AMR – “Anisotropic”: single layer film, 2% change

1985 - GMR – “Giant”: tri-layer film, Cu spacer, 50% change

1995 - TMR – “Tunneling”: tri-layer, thin oxide spacer, 400% change

6Compare inductive head reader to MR

• Inductive & MR essentially the same signal

• MR signal is velocity independent

– Move tape or disk very slowly

• Scalable down to very small dimensions

• Easily fabricated & integrated onto read head

• Can be very small – makes a good scanned probe

Longitudinal Media (side view)

B-x -x -x+x +x+z

t

BV X

IH

+z-z -z

ZMR BV

7NIST – Built MR imaging system

HDD head as a scanned probe magnetic microscope

• Scan MR head in direct contact • Use both the read & write elements

Applications – head, media diagnostics• Calibrate R/W fields/currents• Thermal decay of data• Frequency response of heads• Spatial transfer function

I

VR0+ΔR

MR element

media

8

• Need cutting edge heads, media

• Industry moves very fast – hard to get samples

• Data recovery –

– Need high resolution head than disk written with

– No standard data format

Low level digital hdd data imaged & written

Platter from 1 GB hdd

circa 1996

100 m

9

Other magnetic media

• Video tape

– Helical scan

– sample 1 m

– could be recovered

• Digital Audio tape

12650.00 12750.00 12850.00 12950.00 13050.00

12650.00

12700.00

12750.00

12800.00

12850.00

12900.00

12950.00

13000.00

13050.00

13100.00

•sample 0.1 m

•track pitch 13.6 m

10NTSB - Digital waveform recovery

• Airline flight data recorder – need to evaluate small scraps of tape

• 8 track

• 0.48 in blocks

• Harvard Bi-phase coding

• Sample every 1 m

• Decoded data blocks of data

=> Solution looking for a problem

0 10,000 20,000 Distance (m)

ab

…000001001110…

11FBI - magnetic tape media

forensic audio examinations Cassette & digital audio tapes (DAT), 911 tape (DDS), VHS

Cases: Homicide, armed robbery, fraud, corruption, money

laundering, drugs…

• Very labor intensive

• High profile cases

• Need to testify in court

Authenticity & signal analysis (13)

Voice comparison (44)

Duplication (8)

Audio enhancement (628) 674 cases

Ferrofluidic imaging

12

Other Magnetic Imaging Techniques• Magnetic force microscopy (MFM)

High resolution, polarity sensitive

Cost, mechanical range ~ 0.1 mm, slow

• Scanning SQUID microscopy

Polarity sensitive, long range

Cryogens, low resolution, cost

• Magneto-optically active garnet crystals

High resolution, polarity sensitive

Applied field necessary, complicated optical setup

• Magneto-resistive elements

High resolution, contrast, polarity, fast, long scans, inexpensive,

scalable

Thermal asperities and drift

13

Work-horse analysis technique for forensics investigators

ferrofluid + microscope + dexterity + patience

=> Authenticity analysis - erasure, alteration, duplication

Need to screen entire roles of tape

Need to identify signatures of evidence tampering – head edge marks

Audio tape authenticity evaluation

Write headErase head

tape

Ferro-fluid imageof test tape

4 mm

14

Scanned MR image

Detects zero frequency signalsHigher contrast (45 – 50 dB)Field direction (polarity)High resolution Time consuming ~ 10 - 30 min

15

High resolution computer rendering

Write headstop event Audio test tones

16

Analog waveform recovery

• Test sample with a recording of “F B I” in analog audio S

ign

al (

arb

itra

ry u

nits

)

IF B

Time (seconds)

Audio waveform sent to recorderfrom microphone - "FBI"

(A)

0.600.450.300.150

36000240000 12000

Line scan from MR microscope 5 m wide

Distance (m)

2 m wide sample Sample every 6 m (8 kHz)

4 kHz bandwidthVoice can be identified

~½ second of data (2.5 cm)

Journal of Electron Imaging, 2005

17

National Archives and Records Administration October, 2001

“The Feasibility of Recovering Erased Material

from the 18.5 Minute Gap in the Nixon Tapes”

18

Nixon White House Tapes

• 3700 hours of recordings between Nixon, staff, visitors

• Systems installed by Secret Service in February, 1971

• As many as nine Sony machines– Sound activated microphones in various locations– Thin tape, running very slow– Original recordings were very low quality

• Existence made public during Senate testimony in 1973– Recording stopped soon afterward– Equipment removed in 1974

http://nixon.archives.gov/index.php

19

The infamous 18 ½ minute gap

• June 20, 1972 ( 3 days after breakin)

• Nixon & H.R. Haldeman

• Erased gap with 60 Hz buzz

• Panel of experts prepared report to Judge Sirica

– Tapes were imaged using ferro-fluid technique

– Head events in erased areas match Uher

dictation machine used by secretary

– Rose Mary Woods testified that she may have

accidentally erased some of the tape

– Evidence of at least 5, perhaps nine, separate

and contiguous segments

AP wire story 1/24/2005

20Ferrofluid image of last erase mark from Watergate tape 18 ½ minute gap (Fig. 17, event F)

Courtesy of D. Lacey, B. Koenig

21

• Simulate events using similar machines • Proof of concept

• Record test tapes• Intermittent audio data on vintage Sony deck• Erase entire tape with vintage Uher

• Distribute to participants (gov’t and industry) • Litmus test – recover intelligible audio data

NARA test protocol

22

0 500 1000 1500 2000-0.4

-0.2

0.0

0.2

0.4

0.6

0.8

1.0

1.2

1.4

Line scans from edgeof track on test tape

Sig

na

l (m

icro

volts

)

Distance (mil)

one second

Did find anomalous signals on edge where there was erased audio No recoverable audio there or anywhere else on the test tape

NIST/FBI scanned MR results from NARA test tape

Next step for the FBI : real time tape imaging for authenticity analysis

23

256 element read heads fabricated at NIST

• 13 mm2 footprint dies made on 3” wafer, DRIE to release

– Both 4 mm wide and 13 mm wide arrays

• 16 x 18 LGA on 26 mil pitch

Tape contactsurface

24Sensor configuration

• Wheatstone bridge configuration

• ½ step from V+ to V- to next V- to V+

• Barber-pole sensors

Tape contact surface

4 m

V+V-

16 m

I+I- I-

25Sensors - Anisotropic Magneto-resistance

Magnetic materialNiFe

I

• Key advantages of AMR

• Single magnetic layer

• Low noise at low frequency

• Design considerations

• 45o bias

• Reject thermal asperities

M

H

~2% R change

R cos2θ

R (M || I) > R(M I )

-2 Oe +2 Oe

26“Barber-pole” technique for biasing AMR sensor

• Bias the current at 45o

Aluminum shorts on top of NiFe

• Advantages – simple, high yield

• Disadvantages:

– NiFe films too sensitive

– Magnetization unstable B=0

Need

Stabilize (pin) magnetization

Adjust sensitivity

Sum signals from legs of bridge

MI

Al

V =

IR

IM

BB

-4 -2 0 2 4Field (Oe)

27

Flood field from permanent magnets

Need strong magnets

Stray fields – can affect media

Mechanically complicated

Pin ends of individual elements

More lithography

Not effective for long

elements

Pin vertically from anti-ferromagnetic layer

Simple, self-aligned

Coupling is too strong

Methods of biasing

B

IrMn

28

Tunable anti-ferromagnetic pinning

• Pinning along entire

length of sensor

• Tune strength of pinning

with thickness of Ru

• No stray magnetic fields

• Self aligned process

IrMn

Ru spacer

Wang, et. al JAP (2006)

29

Bridge response using 5 nm Ru spacer

• Linear, no hysterisis for low fields (< 8 Oe)

• 5% change of bridge voltage

30 Bridge with crossed Barberpole AMR’s

• Signals from the legs add – doubles the response to B

• Temperature compensation between all legs

M I +

+-

-B

V+V-

V+V-I+

I-I-

I+

I-

Response

31

Calibration of 256 element die

Calibration of 256 Channel Die

0

50

100

150

200

250

300

0 100 200 300

Channel

Slo

pe

(O

e/V

)

Histogram of slopes

0102030405060708090

0 100 200 300

Slope (Oe/V)

Nu

mb

er

of

se

ns

ors

Dies have high yield ~ 50% (offsets of bridges)

Bridges are homogeneous on dies

32

Include 256 element imager in tape path

• 256 channels @ 8 kHz while tape moving

• Image Cassette, DAT VHS tapes in real time, while listening

Differential16 x 16 MUX

+ Preamps256 channels

16 simultaneousA/D @ 250 kHz

33

Image

Linescan

Erased data

Image erase head events in real time

Record head stop event

Head start

34

Real time audio capture from single track

• 10 seconds of audio

• Can see signature of head stop event as it is played

35

VHS tape images

• Can observe tracks and alignment marks

• Currently studying for evidence of start/stop events

36

Summary• Magneto-resistive microscopy is useful for forensic analysis of audio tape

evidence

– Stop/start events on cassette tapes

– Can recover data from specific areas of the tapes that may not be accessible

to standard read heads

– These techniques may be useful for reading the data from very old tapes that

cannot be played at full speed

• The data on the 18 ½ minute gap in Watergate tapes is probably not recoverable.

• Currently studying erase/stop events on VHS, DAT, DDS tape to fingerprint them.

• Finding other uses for imaging heads

– NDE of IC’s, mechanical integrity, Bio-magnetic sensors (bead counting)

37

38

39

40

• \