Hard Drives & NTFS

Figure 1: Anatomy of a Hard Drive

Hard Drive Anatomy

A hard drive is a complex storage device that is comprised of one or more disks called platters, which store data magnetically. Each platter is divided into smaller sections called sectors, which in turn, are made up of smaller divisions known as bits. To write to these platters, the read/write head passes over, but does not touch, the platter surface and induces a magnetic field, changing the polarity of the bits. The changes in the polarity of these bits can be examined by the read/write head to allow data to be read. In addition, the platter is spun at high speeds, typically ranging from 5,400 to 7,200 RPM, by the spindle, while the arm of the read/write head is moved over the platter using an actuator. These precise movements are all controlled by the IC board, which also stores critical calibration data that becomes increasingly important as data densities increase.

S.M.A.R.T

Modern hard drives are equipped with a sophisticated system known as SMART, or Self-Monitoring, Analysis, and Reporting Technology, which enables constant monitoring of crucial drive performance metrics. These metrics include temperature, power-on hours, error rates, relocated sectors, and other critical performance indicators. SMART sensors record these parameters, which are then analyzed by the drive's firmware to predict potential failures. A user is notified if threshold values are exceeded, indicating a possible impending drive failure. SMART technology is an essential component of modern hard drives, allowing for proactive monitoring of drive health and minimizing the risk of data loss due to hardware failures.

Figure 2: SMART Analysis of a Hard Drive

NTFS File System

NTFS, or New Technology File System, is a file system created by Microsoft and used in modern hard drives. In 2007, BitLocker was introduced to encrypt drives, but it is not enabled by default. This means that most Windows system files can easily be explored even with an account that has a password enabled. NTFS has several main components, including the Boot Sector, which contains the metadata of the drive, and the Master File Table (MFT), which serves as a database of all files on the drive along with their metadata. When files are deleted, their space is marked as free, but the MFT does not shrink. Additionally, mirrored tables are also present on the drive to ensure redundancy and data protection. The File Area is the location where actual files are stored on the drive.

Sources: