Kaplan U - CJ 316 Seminar - Monday Nights 9 pm EST Seminar 1 Chapter 1 Computer Hardware, Software,...

Kaplan U - CJ 316 Seminar - Monday Nights 9 pm EST

Seminar 1 Chapter 1

Computer Hardware, Software, and the Internet


Admin

• Everyone:• Please remember to read all announcements

posted.• Please note proper use of sources• If any questions, please contact instructor,

email• If any other questions, please ask


Section 1.1 Understanding Data


Introduction

In later chapters, this text will detail exactly how computers and the Internet are used in the commission of high-tech crimes, or even aid those committing run-of-the-mill crimes, but before any discussion of high-tech crime can begin, one must first have a baseline understanding of the technology to be discussed.


Definitions

Computers are:• Machines that process data

Electronic Data is:• Information that is transmitted by a series of

electrical impulses. The impulses are strung together to have different meanings, similar to morse code.


Understanding Data

• The smallest piece of data is called a bit.• Binary language is so named because there

are two possible electrical states for each bit of data, on and off.

• On = 1 Off = 0 Think of a light switch in the on or off position.


Bits versus Bytes

• A group of bits together can mean different things. One circuit on or off is pretty meaningless, but when eight circuits are grouped together there are numerous possible combinations.

• Each potential combination can be assigned a different value, and a character such as a letter or number is made of 8 binary bits. For example, the capital letter A is represented by eight bits, 01000001.


Bits versus Bytes, con’t.

• 01000001, or, in electrical terms, off-on-off-off-off-off-off-off-on.

• These 8 bits make up one character (letter, number, punctuation mark, space, etc.).

• 8 bits together are called a byte.• One letter or character = 1 byte of data.


Practical Example:

• Examine a simple sentence like “I am Sam.” We see 7 characters, including the period. In addition, there are two spaces, which are also counted as characters. There are, therefore, a total of 9 characters, or 9 bytes of data, in that sentence.


Practical Example 2:

• I like to eat at restaurants.• 29 total characters, including the spaces and

period, means…


Practical Example 2, con’t.

• I like to eat at restaurants.• 29 total characters, including the spaces and

period, means…• 29 bytes of data in that sentence.


Bigger Bytes

• An entire book would contain millions of bytes. As data structures have become larger, it is common to quantify data capacity sizes using standards for larger measurements such as kilobytes, megabytes, gigabytes, and terabytes.


Kilo, Mega, Giga, and Tera?

• A byte is 8 bits.• A kilobyte is 1,024 bytes.• A megabyte is 1,024 kilobytes.• A gigabyte is 1,024 megabytes.• A terabyte is 1,024 gigabytes.


Why 1,024? Why not 1,000?

• Remember, computer data is binary (on or off) and thus uses powers of 2, not powers of 10 like a decimal number.

• 2x2x2x2x2x2x2x2x2x2 = 1,024• Another way of showing this is by saying 210 =

1,024.


Powers of 2

• 1 byte = 20 bytes• 1 kilobyte = 210 bytes• 1 megabyte = 220 bytes• 1 gigabyte = 230 bytes• 1 terabyte = 240 bytes

Each level is a factor of 10 bigger than the next-lowest level.


Abbreviations

• Bits are always represented by a lower case b. • Bytes are always represented by an upper

case B.• Kilobytes are therefore abbreviated as KB.• Megabytes are MB.• Gigabytes are GB, and so on…


Data Speeds

Now that we have discussed measuring the size of a given chunk of data, we need to discuss how fast we can move that data from place to place. Data flows along electrical circuits in many places on a computer system, and each data pathway is called a bus.


Data Speeds, con’t.

• A bus can only move a certain amount of data at a time. Bandwidth is the term used to measure how much data can travel in a given data path at any given time.

• Think of a water pipe. The wider the pipe, the more data can flow.


Definition: Bandwidth

A rate of data transmission, this is the maximum amount of information that can be transmitted along a data channel. It is commonly measured in units of bits per second, kilobits per second, or megabits per second.


Section 1.2 Computer Hardware


Definition: Hardware

• The physical components of a computer system or its peripheral devices


Tower and Mainboard

• The main and most important component of any computer is its mainboard, also known as the “motherboard.” The following is a simplified view of the basic structure of computer motherboards, with major components labeled for clarity.


Components in the Tower

• Motherboard• Power supply to power the main board, case

cooling fans, and the other installed devices such as hard drives, CD-ROM drives, sound cards, video cards, modems, etc. The power supply has a capacity that is rated in watts, e.g., a 450- watt power supply has more capacity than a 300-watt power supply.


Power Supply

• The capacity ultimately determines how many devices can be connected to the motherboard as it supplies power to each connected device. Mounting too many devices and straining the power supply can make a computer system unstable and prone to crashing.


Components in the Tower, con’t.

• The motherboard is the component that ties all of the other components together, as they all connect directly or indirectly to the motherboard. The main processor resides on the motherboard in a snap-in processor slot. As data flows to and from the main processor to the other components, it travels along one of the system’s buses. Review Diagram 1-4 showing several different components and their respective connections to the motherboard.


Data Bus• Definition: Bus - a path between two components

where electrical impulses travel transmitting data • There are several buses on one computer system,

and they vary according to function and bandwidth. The first bus is the processor’s “data bus.” The data bus is where information moves within the processor and to or from a storage device. This data bus size is determined by the age and type of the processor.


Data Bus, con’t.• A processor referred to as a 32-bit processor

has a 32-bit bus. That simply means that 32 bits of data can be traveling along that processor’s data bus at any one time. As of 2004, 64-bit processors have become available and move data 64 bits at a time, or theoretically in 64-bit pieces, twice as fast. In order to take full advantage of a 64-bit processor, one must use a 64-bit motherboard.


Bus Speeds for Different Uses• PCI Bus = 33 MHz (sound cards, modems,

network card, etc)• AGP Bus = 66 MHz (graphics cards, CD-ROM drives)• IDE Bus = 100 MHz or, in ATA133 systems,

133 MHz (hard drives)• Serial ATA = 150 MB/sec or 300 MB/sec (high-

speed hard drives)• Universal Serial Bus 2.0 (USB) = 480 Mbps


Central Processor• The motherboard is home to the central

processor chip. There are various types of processor sockets standardized by manufacturer and model. The microprocessor computes all commands executed by the computer. The rate at which it performs these calculations determines the speed of the processor.


Processor Speed Ratings• Processors are rated by their relative speed

using Hertz. Hertz, also known as cycles per second, measures the number of calculations a central processor can make within a given time period.

• It is not uncommon to see computers running in the 2.5-4.0 GHz range, although the speeds are constantly increasing. Hertz can be measured in KHz, MHz, and GHz.


AGP Bus and PCI Express• Other devices on the computer’s

motherboard also have buses, for example, the AGP bus, which is a 32-bit bus for video graphics. AGP slots are commonly used for sending data to and from video graphics cards. The newest bus specifically devoted to graphics cards is the Express PCI bus.


PCI Express and the PCI Bus• PCI Express is an updated version of the

longstanding PCI bus, which is used to connect expansion cards to the add-on slots on the motherboard. These expansion cards can be sound cards, modems, network interface cards, additional ports such as USB ports, etc. They allow for a user to add new devices to a computer or upgrade existing performance.


Universal Serial Bus (USB)• Another increasingly common bus is the

Universal Serial Bus, commonly called “USB.” Because there were so many different and divergent bus and connection standards, industry professionals decided to try to create a standard connection for all brands and a wide variety of devices. A conglomerate of many top vendors created the USB standard.


More About the BusThese buses move data to and from many different

types of components. Knowing the difference between PCI Express (a commonly used bus for high-end graphics cards) and Universal Serial Bus (USB connections used for myriad devices) is considered common knowledge among entry- to mid-level computer users. A general knowledge of bus types, memory capacities, and processor speeds will all give an investigator credibility in court. A lack of this baseline knowledge will be devastating when cross-examined by a dedicated defense attorney.


Random Access Memory (RAM)• Also connected to the motherboard is the system’s

RAM, which allows the computer to temporarily store information in its “short-term memory.” RAM is very fast and efficient, relying on electrical impulses to read and write small pieces of data.

• RAM will only store data temporarily and is cleared whenever a computer is powered down. RAM is measured in terms of how much data it can store (megabytes of RAM) and how fast it can find it (seek time). RAM also functions at a certain rate of speed, measured in MHz.


Mass Storage Devices - Hard Drives

• The computer will read from and write to a hard disk drive for long-term or permanent data storage, even if the computer is turned off.

• Comparable to the the human mind, RAM contains the equivalent of what one is actively concentrating on at a given moment, whereas the hard drive storage is the equivalent of all of the knowledge obtained during one’s lifetime.

• Hard drive capacity is greatly larger than RAM capacity, but, like the human mind, long-term memories are slower to access, similar to having to concentrate to remember something.


Hard Drives, con’t.• Hard Drives have moving component parts and are

therefore slower than RAM, which relies only on electrical impulses.

• Hard drives have magnetic discs called platters. The platters spin around a central axis, not unlike a record player, while a read-and-write arm moves back and forth across the surface of the disk. At the end of the read-and- write arm there is a read / write head that finds the correct area of the disk and reads or writes information there.


More on Hard Drives• The circular drive is divided into concentric circles

that are very large at the outside edge of the platter and get progressively smaller as you work toward the center. Each ring is called a track. A standard hard drive generally has 1,024 tracks, starting with track 0 on the outside edge and ending with track 1,023 closest to the center of the drive.

• Tracks are divided into smaller segments called sectors. A line from the center of the platter to the outside divides one sector from another.


Tracks, Sectors, and Clusters• Sector size is determined when the drive is first

formatted by the operating system (e.g., Windows®, or Linux®), but sectors are almost always 512 bytes in capacity.

• If a piece of data is larger than 512 bytes, it will occupy multiple sectors; for example, an 800 KB file will be assigned to two sectors. Sectors that are grouped together are called clusters. In an ideal situation, data will be stored in sectors that are contiguous, or adjacent to each other.


Slack Space• Although individual sectors can generally contain up

to 512 bytes of data, files do not come in nice, round 512-byte packages.

• Wasted space within a sector is quite common; for example, a 300-byte file will leave 212 bytes of wasted space within that sector. This is sometimes referred to as the file slack, or slack space.

• Slack space can be important to the investigator because the 300-byte file will not overwrite that 212-byte space, leaving any old data there. Investigators can recover those data fragments left behind in slack space and examine them.


Master Boot Record (MBR)• Hard drives need a table of contents, which

tells the computer how the hard drive is laid out and formatted.

• The very first sector of the hard drive is called the Master Boot Record (MBR).

• The location of the MBR is always cylinder 0, head 0, sector 1, which is also listed as (0,0,1). This can also be described as track 0, side 0, sector 1.


Master Boot Record, con’t.• The MBR is important to the investigator as

the partition tables can indicate the number of volumes a hard drive is divided into.

• A single hard drive could be partitioned to appear as drives C, D, and E if it were divided into 3 partitions. All 3 drives, or volumes, exist on 1 physical hard drive, but appear as 3 separate virtual drives.


Hard Drive Performance• Revolutions per minute (RPMs) of the spinning

platters - common drive speeds range from 5,400 to 10,000 RPMs, with 7,200 RPMs being very common for home systems.

• A drive cache is a small on board electrical impulse memory cache to assist with storing small bursts of data. It generally ranges from 2 MB to 8 MB in size.

• Bus speed to the rest of the system - hard drives are generally ATA 133 or Serial ATA (SATA) on newer systems.


Hard Drive Bus Speeds and Capacity

• Hard drives are generally connected via an ATA133 connection, meaning that they can transfer 133 MBs per second.

• Older hard drives and most CD-ROM drives are connected at ATA66, which means they transfer up to 66MB/sec.

• The up-and-coming standards are Serial ATA, with a bandwidth of 150 MB/sec, and Serial ATA II, 300 MB/sec (Serial ATA International Organization, 2006).

• Drive capacity (measured in gigabytes)


Optical Drives• CD-ROM / DVD-ROM and burners• Another way to store data is by writing it to optical

discs, such as CDs and DVDs.• CDs generally hold approximately 650-700 MB of

information, • Single layer DVDs hold up to 4.7 GB. Newer dual-

layer DVDs can hold up to 9.4 GB of data. A writer such as a CD writer and DVD writer is often called a “CD burner” or DVD burner,” as it etches data onto the surface of the optical disc via a small laser beam.


Optical Drive Speeds• A common CD writer, commonly called a “burner,”

will have numbers similar to 52X / 10X / 52X (write / rewrite / read).

• When optical drives were first created, they wrote at 1X. 1X is also equivalent to writing 150 KB (kilobytes) per second for a CD burner.

• For a DVD burner, the default 1X speed is 1.385 MB/sec. CD burners are currently rated at up to 52X, which is equivalent to approximately 7.6 MB/sec (52X150 KB = 7800 KB / 1,024 = 7.6 MB).


Peripheral Devices• Human input devices (mouse, keyboard)• Scanners• Printers• External storage (USB key)• Modems (dial-up or broadband)• Cameras (digital still and digital video) • Scientific instruments


Peripheral Devices, con’t.• Connect to the computer via ports on the

motherboard. Examples include PS/2 ports for human input devices like mice and keyboards, parallel ports for older printers, and USB ports for most modern devices.

• A new trend is the use of external flash memory to store data. These “thumb drives” or “USB keys” connect to the computer via a USB port and can store data indefinitely. They contain small flash memory chips.


Hardware Summary• Computer hardware cannot move or

otherwise manipulate data in a vacuum. • Hardware relies on instructions to tell one

piece of hardware what to do in relation to another piece.

• Without any installed software, computer hardware is nothing more than a stack of electrical components with no known tasks, and no way to carry them out.

Kaplan U - CJ 316 Seminar - Monday Nights 9 pm EST Seminar 1 Chapter 1 Computer Hardware, Software,...

Documents

Transcript of Kaplan U - CJ 316 Seminar - Monday Nights 9 pm EST Seminar 1 Chapter 1 Computer Hardware, Software,...