Computer Hardware Fundamentals for Forensic Examiners

The motherboard connects processor, memory, peripherals and firmware. Its diagram is a guide to possible data paths, not a rule that every byte passes through a separate chipset. Modern processors commonly integrate a memory controller and provide some direct PCIe connectivity; other devices connect through supporting platform logic.

For acquisition, identify the complete connection path: source device, controller, adapter, write blocker, workstation and destination. The slowest usable component can limit throughput. Device errors, hashing, compression and the acquisition scope also affect duration, so interface labels alone do not predict a fixed imaging time.

Legacy BIOS and UEFI participate in starting a system and selecting a boot target. UEFI variables can describe boot entries and security configuration. Variables with nonvolatile attributes are intended to survive power cycles; the specification does not prescribe one physical storage implementation for every system.

A battery-backed real-time clock is a separate function from nonvolatile firmware storage. A weak battery can contribute to clock problems, but a displayed wrong date does not uniquely diagnose the battery. Record time-zone settings, system time and a reliable comparison time, and evaluate synchronisation or later corrections before adjusting an evidential timeline.

Changing firmware settings or booting a device to inspect them can itself alter evidence. Record the reason, authority and observed changes, and use a competent platform-specific procedure.

A processor executes instructions using architectural registers and internal state. Caches retain selected copies of memory data and instructions to reduce access costs. L1, L2 and L3 describe levels in a design, not a chronological queue of newest-to-oldest instructions.

Capacity, sharing, timing and register sets differ by architecture and model. Identify whether the platform is, for example, x86-64 or ARM64, because tools, data interpretation and acquisition capabilities depend on that architecture. A process can also use virtual memory that is not all resident in physical RAM.

Ordinary operating-system memory acquisition does not promise a separate complete capture of every processor register and cache. Debugging, crash records, virtualisation and specialist interfaces can expose some state under particular conditions. Describe what the selected acquisition actually records instead of asserting that processor state is always recoverable or never recoverable.

Multiple cores and threads can continue changing memory during collection. Suspending one process does not freeze the entire operating system. A live memory image is generally collected over an interval, so inconsistent or incomplete structures can reflect acquisition timing as well as corruption.

DRAM requires power and refresh to maintain normal operation. DIMM generation, form factor and controller support determine compatibility; some systems use soldered or integrated memory. Moving components is not a routine evidence-preservation shortcut and may be impossible or destructive.

ECC adds error-detection and correction capabilities whose coverage depends on the memory scheme and platform. It is a reliability mechanism, not proof that an application log is authentic. A hardware error report needs interpretation in context; a corrected hardware event does not certify a particular evidential entry.

Live memory can contain process code, mapped data, network state, session material and, in some circumstances, accessible encryption-related material. Contents depend on software, protection mechanisms and timing. Killing an application does not guarantee immediate removal of every related byte, and a mounted encrypted volume does not guarantee that an available tool can extract a reusable key.

Paging and crash or hibernation files can retain some memory-related information on persistent storage, but they are not interchangeable with a complete current RAM image. Preserve their provenance and relevant platform/version information.

Assess whether authorised live collection is feasible before choosing it. A locked screen is not a tool-execution interface, and inserting a USB device does not automatically grant the privileges needed for memory capture. Preserve available power and state where justified, seek suitable access or specialist support, and document the trade-offs.

An HDD stores information magnetically; an SSD uses nonvolatile storage managed by a controller. SATA and NVMe describe different storage interfaces or protocols, while M.2 describes a physical form factor. Some M.2 devices use SATA, and NVMe is not limited to one physical shape. Check the actual device and connector support.

Acquisition tools normally read the device’s exposed logical address space. Deleted-file recovery from that space depends on filesystem metadata, overwriting, deallocation, encryption and device behaviour. A mechanical drive does not guarantee weeks of recovery, and a solid-state label does not establish that every deleted byte has already disappeared.

Flash controllers use a translation layer to map logical addresses to physical storage. Wear levelling, error management and reserved capacity can move or hide physical pages from an ordinary host read. Physical access to chips does not automatically reconstruct usable files, particularly where mapping, scrambling or encryption intervene.

ATA TRIM and related deallocation operations tell a device that specified logical ranges need no longer retain their old contents. A subsequent read can return implementation-dependent results, including zeros, even before a researcher could establish when physical erasure occurred. Garbage collection and actual erasure are controller processes; there is no universal seconds-to-erasure timetable.

A write blocker should be suitable and tested for the actual interface and commands. Preventing host writes does not freeze every internal controller operation, reverse earlier deallocation or expose reserved physical storage. Retain error logs and report what the device returned during the acquisition.

Other media require their own approach. Removable flash, eMMC, optical media and soldered storage differ in access, rewritability and controller behaviour. Do not assume a media class is absent from current cases or that its recovery capability follows a national procurement pattern.

Hash verification helps establish consistency of the captured bytes under the stated method. It does not demonstrate that an image contains all historical content or settle admissibility. Legal requirements vary by jurisdiction; the collection record should explain scope, access, errors and relevant changes.

A computer can have physical, virtual, disabled or disconnected network interfaces. Record the interfaces and identifiers relevant to the case, without assuming that each physical adapter has an externally visible label or that every system includes wired networking.

MAC addresses commonly identify link-layer interfaces within a particular network context. A globally administered address may carry an organisational allocation, but private addressing, randomisation, spoofing and virtualisation limit manufacturer and device attribution from an observed address alone.

Modern platforms can use different addresses during scanning and association, including per-network private addresses. A probe or access-point log therefore needs its own time, context and retention assessment. Neither one MAC address nor an IP address independently identifies the human operating a device.

Network profiles and connection records are operating-system artefacts, not necessarily a list stored in the adapter. On Windows, distinguish the SOFTWARE registry hive and relevant WLAN or network-profile records from the SYSTEM hive. Profile creation or modification does not automatically provide a complete connection history.

Correlate suitable host records, infrastructure logs and time settings. Identify which source observed an association, address assignment or traffic flow, and what uncertainty remains. Retention and lawful access to those records depend on the service and jurisdiction.

Power transitions can change both volatile and persistent evidence. Main-power disconnection may leave a battery-powered laptop running; a UPS, sleep state, hibernation or standby design also changes the consequences. Establish the actual state rather than infer it solely from a closed lid or silent fan.

A simplified boot sequence involves firmware initialisation, boot selection and transfer to an operating-system loader. Exact behaviour, diagnostic retention and security checks depend on the platform. Secure Boot supports a defined trust policy; it does not certify that every application or historical event is trustworthy.

Normally accessible live RAM state can be lost when power is removed. Nonvolatile storage and firmware variables have different persistence properties, while an RTC may depend on a battery. Remanence research does not create a dependable routine recovery window after shutdown.

Prioritise the evidence needed, its likely rate of change and the ability to collect it without unacceptable effects. Encryption access, remote changes, business continuity, hazards and scope of authority may alter the plan. Neither universal immediate shutdown nor universal live acquisition is an adequate rule.

For practical collection decisions, continue to Digital First Response. Keep sources, tool versions, times and integrity checks traceable.