Driver Level I/o Access To Hard Drives???
Anyone here who knows how the lowest level I/O works to read/write sectors(?) on hard drives these day?
some 15 years ago I created a file system and back then If I wanted to I had complete control of every bit on the the hard drive including the bad sector map.
I am interested if someone accused of murder today (Hans Reiser who created the ReiserFS (files system for linux) can go and manupulate the drives to change dates etc and the trace of activity that the forensic PC expert looked at for a whole day (he said he looked at only about 30% of the storage media)… and he found the trace of disk back-up taking place starting at 2:30 PM and then computer games being played after 1.5 hrs later for how long I don’t know. But this supposedly created an “alibi” for Hans Reiser that he was at the house during the time that his missing wife was supposedly driving away from his house.
Pleasde answer only if you know what I am asking for and know how disk I/O is done.
Disk I/O in Windows is done in the kernel, through the HAL and, if necessary, proprietary (to the drive) drivers.
Disk I/O in Linux is open, since the entire OS is open. One has nothing to do with the other.
(If a disk system journals, everything, including the last non-forensic read, is available to examine later. [Forensic reads aren't done through the OS, so the OS can't journal them.])