1. 1 David P. Pappas Fabio da Silva Sean Halloran Alexey Nazarov NIST, Boulder, CO Ken Marr, James Ryan FBI Academy, Quantico, VA Magnetic Forensics The Lost 18 ½ minutes of the Nixon Presidency => a magnetic microscopy study NIST Competence Program

2. 2 Outline Development of magnetic sensors –Hard disk drives Cassette & DAT Tape How data is stored on tapes Analysis of magnetic tapes –Authenticity –Data recovery Studies of magnetic tapes –NARA test tapes for Nixon 18 ½ minute gap Development of high resolution real-time imaging system Outlook for data-recovery using high resolution imaging

3. 3 Intense development of magnetic sensors has enabled high density hard disk drive (hdd) storage Thomas N. Theis and Paul M. Horn, Phys. Today, July 2003

4. 4 Improvements in areal density Magneto- Resistive Read Elements Small,sensitive Error code correction Small bits Mechanical actuators, interface Write heads Smaller, stronger Heads Media High stability Commercial technology at ~ 100 Gbit/in 2, demos ~ 300 Currently limited by field strengths of write heads Enabled by the existence of magneto-resistive read elements

5. 5 What is a Magneto-Resistor? Thin film resistor made with magnetic material (NiFe, Co) Magnetization (M) B-field Resistance: R for M || > R for M ┴ Ohm Meter 1890 - AMR – “Anisotropic”: single layer film, 2% change 1985 - GMR – “Giant”: tri-layer film, Cu spacer, 50% change 1995 - TMR – “Tunneling”: tri-layer, thin oxide spacer, 400% change

6. 6 Compare inductive head reader to MR Inductive & MR essentially the same signal MR signal is velocity independent –Move tape or disk very slowly Scalable down to very small dimensions Easily fabricated & integrated onto read head Can be very small – makes a good scanned probe Longitudinal Media (side view) -x +x +z -z

7. 7 NIST – Built MR imaging system HDD head as a scanned probe magnetic microscope Scan MR head in direct contact Use both the read & write elements Applications – head, media diagnostics Calibrate R/W fields/currents Thermal decay of data Frequency response of heads Spatial transfer function I V R0+ΔRR0+ΔR MR element media

8. 8 Need cutting edge heads, media Industry moves very fast – hard to get samples Data recovery – –Need high resolution head than disk written with –No standard data format Low level digital hdd data imaged & written Platter from 1 GB hdd circa 1996 100  m

9. 9 Other magnetic media Video tape –Helical scan –sample 1  m –could be recovered Digital Audio tape sample 0.1  m track pitch 13.6  m

10. 10 NTSB - Digital waveform recovery Airline flight data recorder – need to evaluate small scraps of tape 8 track 0.48 in blocks Harvard Bi-phase coding Sample every 1  m Decoded data blocks of data => Solution looking for a problem 0 10,000 20,000 Distance (  m) ab …000001001110…

11. 11 FBI - magnetic tape media forensic audio examinations Cassette & digital audio tapes (DAT), 911 tape (DDS), VHS Cases: Homicide, armed robbery, fraud, corruption, money laundering, drugs… Very labor intensive High profile cases Need to testify in court 674 cases Ferrofluidic imaging

12. 12 Other Magnetic Imaging Techniques Magnetic force microscopy (MFM) High resolution, polarity sensitive  Cost, mechanical range ~ 0.1 mm, slow Scanning SQUID microscopy Polarity sensitive, long range  Cryogens, low resolution, cost Magneto-optically active garnet crystals High resolution, polarity sensitive  Applied field necessary, complicated optical setup Magneto-resistive elements High resolution, contrast, polarity, fast, long scans, inexpensive, scalable  Thermal asperities and drift

13. 13 Work-horse analysis technique for forensics investigators ferrofluid + microscope + dexterity + patience => Authenticity analysis - erasure, alteration, duplication  Need to screen entire roles of tape  Need to identify signatures of evidence tampering – head edge marks Audio tape authenticity evaluation Write head Erase head tape Ferro-fluid image of test tape 4 mm

14. 14 Scanned MR image  Detects zero frequency signals  Higher contrast (45 – 50 dB)  Field direction (polarity)  High resolution  Time consuming ~ 10 - 30 min

15. 15 High resolution computer rendering Write head stop event Audio test tones

16. 16 Analog waveform recovery Test sample with a recording of “F B I” in analog audio  2  m wide sample  Sample every 6  m (8 kHz)  4 kHz bandwidth  Voice can be identified ~½ second of data (2.5 cm) Journal of Electron Imaging, 2005

17. 17 National Archives and Records Administration October, 2001 “The Feasibility of Recovering Erased Material from the 18.5 Minute Gap in the Nixon Tapes”

18. 18 Nixon White House Tapes 3700 hours of recordings between Nixon, staff, visitors Systems installed by Secret Service in February, 1971 As many as nine Sony machines –Sound activated microphones in various locations –Thin tape, running very slow –Original recordings were very low quality Existence made public during Senate testimony in 1973 –Recording stopped soon afterward –Equipment removed in 1974 http://nixon.archives.gov/index.php

19. 19 The infamous 18 ½ minute gap June 20, 1972 ( 3 days after breakin) Nixon & H.R. Haldeman Erased gap with 60 Hz buzz Panel of experts prepared report to Judge Sirica –Tapes were imaged using ferro-fluid technique –Head events in erased areas match Uher dictation machine used by secretary –Rose Mary Woods testified that she may have accidentally erased some of the tape –Evidence of at least 5, perhaps nine, separate and contiguous segments AP wire story 1/24/2005

20. 20 Ferrofluid image of last erase mark from Watergate tape 18 ½ minute gap (Fig. 17, event F) Courtesy of D. Lacey, B. Koenig

21. 21 Simulate events using similar machines Proof of concept Record test tapes Intermittent audio data on vintage Sony deck Erase entire tape with vintage Uher Distribute to participants (gov’t and industry) Litmus test – recover intelligible audio data NARA test protocol

22. 22 one second Did find anomalous signals on edge where there was erased audio  No recoverable audio there or anywhere else on the test tape NIST/FBI scanned MR results from NARA test tape Next step for the FBI : real time tape imaging for authenticity analysis

23. 23 256 element read heads fabricated at NIST 13 mm 2 footprint dies made on 3” wafer, DRIE to release –Both 4 mm wide and 13 mm wide arrays 16 x 18 LGA on 26 mil pitch Tape contact surface

24. 24 Sensor configuration Wheatstone bridge configuration ½ step from V+ to V- to next V- to V+ Barber-pole sensors Tape contact surface 4  m V+V- 16  m I+ I-

25. 25 Sensors - Anisotropic Magneto-resistance Magnetic material NiFe I Key advantages of AMR Single magnetic layer Low noise at low frequency Design considerations 45 o bias Reject thermal asperities M H ~2% R change  R  cos 2 θ R (M || I ) > R(M  I ) -2 Oe +2 Oe

26. 26 “Barber-pole” technique for biasing AMR sensor Bias the current at 45 o Aluminum shorts on top of NiFe Advantages – simple, high yield Disadvantages: –NiFe films too sensitive –Magnetization unstable B=0  Need  Stabilize (pin) magnetization  Adjust sensitivity  Sum signals from legs of bridge M I Al V = IR I M BB -4 -2 0 2 4 Field (Oe)

27. 27  Flood field from permanent magnets  Need strong magnets  Stray fields – can affect media  Mechanically complicated  Pin ends of individual elements  More lithography  Not effective for long elements  Pin vertically from anti-ferromagnetic layer  Simple, self-aligned  Coupling is too strong Methods of biasing B IrMn

28. 28 Tunable anti-ferromagnetic pinning Pinning along entire length of sensor Tune strength of pinning with thickness of Ru No stray magnetic fields Self aligned process IrMn Ru spacer Wang, et. al JAP (2006)

29. 29 Bridge response using 5 nm Ru spacer Linear, no hysterisis for low fields (< 8 Oe) 5% change of bridge voltage

30. 30 Bridge with crossed Barberpole AMR’s Signals from the legs add – doubles the response to B Temperature compensation between all legs M I + + - - B V+V- V+ V- I+ I- I+ I- Response

31. 31 Calibration of 256 element die Dies have high yield ~ 50% (offsets of bridges) Bridges are homogeneous on dies

32. 32 Include 256 element imager in tape path 256 channels @ 8 kHz while tape moving Image Cassette, DAT VHS tapes in real time, while listening Differential 16 x 16 MUX + Preamps 256 channels 16 simultaneous A/D @ 250 kHz

33. 33 Image Linescan Erased data Image erase head events in real time Record head stop event Head start

34. 34 Real time audio capture from single track 10 seconds of audio Can see signature of head stop event as it is played

35. 35 VHS tape images Can observe tracks and alignment marks Currently studying for evidence of start/stop events

36. 36 Summary Magneto-resistive microscopy is useful for forensic analysis of audio tape evidence –Stop/start events on cassette tapes –Can recover data from specific areas of the tapes that may not be accessible to standard read heads –These techniques may be useful for reading the data from very old tapes that cannot be played at full speed The data on the 18 ½ minute gap in Watergate tapes is probably not recoverable. Currently studying erase/stop events on VHS, DAT, DDS tape to fingerprint them. Finding other uses for imaging heads –NDE of IC’s, mechanical integrity, Bio-magnetic sensors (bead counting)

37. 37

38. 38

39. 39

40. 40 \