HDD
Hard Disk Drive
Magnetische Festplatte
An HDD is a magnetic storage medium with rotating platters and moving read/write heads. In IT forensics it is particularly rewarding: deleted data often remains physically present until it is overwritten, so much can be reconstructed. Compared with the Solid State Drive (SSD), its behaviour is more predictable for evidence preservation.
History & facts. On an HDD, „deleting“ a file usually only removes the reference in the file system; the actual content initially remains on the magnetic platter. Forensic methods such as file carving can reconstruct such remnants; the slack space — unused room at the end of allocated blocks — can also contain traces. This predictability fundamentally distinguishes the HDD from the Solid State Drive (SSD).
Outlook & recommendation. SSDs are increasingly displacing HDDs, but in legacy systems, archives and large stores, magnetic disks remain relevant. For forensics: a bit-exact image with subsequent hash preservation is the clean first step. Anyone wanting to render data securely unusable must actually overwrite it on an HDD (wiping) — simple deletion is not enough.