Malware detection is typically performed using either software scanners running inside the operating system or external devices designed to validate the integrity of the kernel. This thesis proposes a hypervisor-based malware that compromises the system by targeting the hard disk drive and leaving the kernel unmodified. The hypervisor is able to issue read and write commands to the disk while actively hiding these actions from the operating system and any detection software therein. Additionally, the hypervisor’s presence has minimal impact on the performance of the system. The ability to perform these commands compromises the confidentiality, integrity, and availability of the stored data. As a result, this thesis has widespread implications affecting personal, corporate, and government users alike.

This thesis explores hardware command capture as a viable means of analyzing real world hard drive usage. Hardware command capture provides insight into the IO stack where current tools fail to reach. A software platform is presented which provides trace conversion and analysis capabilities. This platform is written in Python and designed to handle traces of arbitrary size while being easily extensible for future projects to build upon. A novel Sequential Stream Detection algorithm built upon the software platform is then presented. This algorithm detects application level sequential streams and provides interesting insight into the sequential nature of the applications analyzed. The software platform and Sequential Stream Detector were validated and run against a range of workloads including video playback, large project compilations, and synthetic benchmarks. Where applicable, each workload was run on multiple file systems (ext2, ext3, ext4, Btrfs) to compare the effects of stream allocation across file systems. It is shown that stream allocation is consistent across file systems suggesting stream detection may be a valuable workload identification tool.

The ability to accurately predict an impending hard disk failure is important for reliable storage system design. The facility provided by most hard drive manufacturers, called S.M.A.R.T. (self-monitoring, analysis and reporting technology), has been shown by current research to have poor predictive value. The problem of finding alternatives to S.M.A.R.T. for predicting disk failure is an area of active research. In this work, we present a rule discovery methodology, and show that it is possible to construct decision support systems that can detect such failures using information recorded from live disks. It is desired that any such prediction methodology should have high accuracy and must have ease of interpretability. Black box models can deliver highly accurate solutions but do not provide an understanding of events which explains the decision given by it. To this end we explore rule based classifiers for predicting hard disk failures from various disk events. We show that it is possible to learn easy to understand rules from disk events. Our evaluation shows that our system can be tuned either to have a high failure detection rate (i.e., classify a bad disk as bad) or to have a low false alarm rate (i.e., not classify a good disk as bad). We also propose a modification of MLRules algorithm for classification of data with imbalanced class distributions. The existing algorithm, assuming relatively balanced class distributions and equal misclassfication costs, performs poorly in classification of such datasets. The performance can be considerably improved by introducing cost- sensitive learning to the existing framework.

Computing system power consumption is a concern as it has financial and environmental implications. These concerns will increase in the future due to the current trends in data growth, information availability requirements, and increases in the cost of energy. Data growth is compounded daily because of the accessibility of portable devices, increased connectivity to the Internet, and a trend toward storing information electronically. These three factors also result in an increased demand for the data to be available for access at all times which results in more electronic devices requiring power. As more electricity is required the overall cost of energy increases due to demand and limited resource availability. The environment also suffers as most electricity is generated from fossil fuels which increase emission of carbon dioxide into the atmosphere. In order to reduce the amount of energy required while maintaining data availability researchers have focused on changing how data is accessed from hard drives. Hard drives have been found to consume 10 to 86 percent of a system's energy. Through changing the way data is accessed by implementing multi speed hard drives, algorithms that prefetch, cache, and batch data requests, or by implementing flash drive caches researchers have been able to reduce the energy required from hard drive operation. However, these approaches often result in reduced I/O performance or reduced data availability. This dissertation provides a new method of reducing hard drive energy consumption by implementing a prefetching technique that predicts a chain of future requests based upon previous request observations. The files to be prefetched are given to a caching system which uses a flash memory device for caching. This caching system implements energy sensitive algorithms to optimize the value of files stored in the flash memory device. Through prefetching files the hard drive on a system can be placed in a low power sleep state. This results in reduced power consumption while providing high I/O performance and data availability. Analysis of simulator results confirmed that this new method increased I/O performance and data availability over previous studies while also providing a higher level of energy savings. Out of 30 scenarios, the new method displayed better energy savings in 26 scenarios and better performance in all 30 scenarios over previous studies. The new method also displayed it could achieve results of 50.9 percent less time and 34.6 percent less energy for a workload over previous methodologies.

This thesis looked at three encryption applications that all use the symmetric encryption algorithms AES, Twofish and Serpent but differ in their implementation and how this difference would illustrate itself in performance benchmarks depending on the type of storage device that they were used on. Three mechanical hard drives and one solid state drive were used in the performance benchmarks which measured a variety of different disk operations across the three encryption applications and their algorithms. From the benchmarks performance charts were produced which showed that DiskCryptor had the best performance when using a solid state drive and that TrueCrypt had the best performance when using mechanical hard drives. By choosing DiskCryptor as the encryption application when using a solid state drive a performance increase of 38.9% compared to BestCrypt and 28.4% compared to TrueCrypt was achieve when using the AES algorithm. It was also shown that Twofish was overall the best performing algorithm. The primary conclusion that can be drawn from this thesis is that it is important to choose the right encryption application depending on the type of storage device used in order to get the best performance possible.

As the superparamagnetic limit is reached, the magnetic storage industry looks to circumvent the barrier by implementing patterned media (PM) as a viable means to store and access data. Chemical mechanical polishing (CMP) is a semiconductor fabrication technique used to planarize surfaces and is investigated as a method to ensure that the PM is polished to surface roughness parameters that allow the magnetic read/write head to move seamlessly across the PM. Results from this research have implications in feasibility studies of utilizing CMP as the main planarization technique for PM fabrication. Benchmark data on the output parameters of the CMP process, for bit patterned media (BPM), based on the machine process parameters, pad properties, and slurry characteristics are optimized. The research was conducted in a systematic manner in which the optimized parameters for each phase are utilized in future phases. The optimum results from each of the phases provide an overall optimum characterization for BPM CMP. Results on the CMP machine input parameters indicate that for optimal surface roughness and material removal, low polish pressures and high velocities should be used on the BPM. Pad characteristics were monitored by non destructive technique and results indicate much faster deterioration of all pad characteristics versus polish time of BPM when compared to IC CMP. The optimum pad for PM polishing was the IC 1400 dual layer Suba V pad with a shore hardness of 57, and a k-groove pattern. The final phase of polishing evaluated the slurry polishing properties and novel nanodiamond (ND) slurry was created and benchmarked on BPM. The resulting CMP output parameters were monitored and neither the ND slurry nor the thermally responsive polymer slurry performed better than the commercially available Cabot iCue slurry for MRR or surface roughness. Research results indicate CMP is a feasible planarization technique for PM fabrication, but successful implementation of CMP for planarizing PM must address the high initial start up cost, increase in the number of replacement pads, and increase in polishing time to reach the required surface roughness for magnetic storage devices.

A non-contact angular measurement system for Pitch Static Attitude (PSA) and Roll Static Attitude (RSA) of hard disk drive sliders is designed and built. Real-time sampling at over 15 KHz is achieved with accuracy of +/- 0.05 degrees over a range of approximately 2-3 degrees. Measuring the PSA and RSA is critical for hard drive manufacturers to control and improve the quality and reliability of hard drives. Although the hard drive industry is able to measure the PSA and RSA at the subassembly level at this time, there is no system available that is able to measure PSA/RSA at the final assembly level. This project has successfully demonstrated a methodology that the PSA/RSA can be reliably measured in-situ using a laser and position sensitive detector (PSD) technology. A prototype of the measurement system has been built using simple and inexpensive equipment. This device will allow a continuous measurement between the parked position on the ramp and the loading position just off of the disk surface. The measured data can be used to verify manufacturing processes and reliability data.

This thesis compares the impact on disk performance in a GNU/Linux  environmentwith three encryption algorithms: AES,  Serpent and Twofish in three different implementations: DM-crypt, Loop-AES and Truecrypt. For all three algorithms a key length of 256 bits is used. The thesis shows that the least performance impact during data encryption, and thus file writing, is reached by using AES or Twofish encryption implemented in DM-crypt or TrueCrypt. The thesis shows that some data operations with a sufficiently low processor utilization barely affects disk performance at all if encrypted using the optimal implementation and algorithm. It is also discovered that the performance impact during data decryption, or file reading, can be minimized by using the most efficient implementation and algorithm. The best results are met with the AES or Twofish cipher, regardless of implementation. An important conclusion that  is  drawn is that it is hard to determine a superior encryption solution for all purposes. However, by reviewing and examining the collected data from all aspects of disk performance the AES implementation in TrueCrypt is, with small marginals, determined to be the most optimal. / Undersökningen jämför hur krypteringsalgoritmerna AES, Serpent och Twofish implementerade i DM-crypt, Loop-AES och TrueCrypt påverkar diskprestandan i en GNU/Linux-miljö. Samtliga krypteringsalgoritmer tillämpas med en nyckellängd på 256 bitar. Undersökningen visar att högst skrivhastighet och således krypteringshastighet uppnås med algoritmerna AES och Twofish i DM-crypt eller Truecrypt. Krypteringens påverkan på diskprestanda är beroende av vilka typer av operationer som utförs och hur hög processorsysselsättningsgraden är. Vid  simplare  I/O-operationer har  den mest optimala  krypteringslösningen knappt någon påverkan på diskprestandan överhuvudtaget. Undersökningen visar också att påverkan av prestanda vid dekryptering är minst vid tillämpning av AES eller Twofish oavsett implementering. En viktig slutsats som dras är att det inte finns en överlägsen krypteringslösning för samtliga användningsområden. Genom att sammanställa och granska insamlad data gällande samtliga aspekter beträffande diskprestanda fastställs TrueCrypts implementation av AES till att vara den mest optimala, trots små marginaler.

No description available.

We present an on-disk sequence cache (ODSC), which improves disk drive performance. An ODSC uses a separate disk partition to store disk data in the order that the operating system requests it. Storing data in this order reduces the amount of seeking that the disk drive must do. As a result, the average disk access time is reduced. Reducing the disk access time improves the performance of the system, especially when booting the operating system, loading applications, and when main memory is limited. Experiments show that our ODSC speeds up application loads by as much as 413%. Our ODSC also reduces the disk access time of the Linux boot by 396%, and speeds up a Linux kernel make by 28%. We also show that an ODSC improves performance when main memory is limited.