Manipulation of hard drive firmware to conceal entire partitions

Huw Read, Konstantinos Xynos, Iain Sutherland, Gareth Davies, Tom Houiellebecq, Frode Roarson, Andrew Blyth

    Allbwn ymchwil: Cyfraniad at gyfnodolynErthygladolygiad gan gymheiriaid

    Crynodeb

    Tools created by the computer hacking community to circumvent security protection on hard drives can have unintentional consequences for digital forensics. Tools originally developed to circumvent Microsoft's Xbox 360 hard drive protection can be used, independently of the Xbox 360 system, to change the reported size/model of a hard drive enabling criminals to hide data from digital forensic software and hardware. The availability of such concealment methods raises the risk of evidence being overlooked, particularly as triage and on-scene inspections of digital media become more common. This paper presents two case studies demonstrating the process using Western Digital and Fujitsu branded drives. It outlines the difficulties faced by standard computer forensic analysis techniques in revealing the true nature of the drive and finally provides suggestions for extra checks to reveal this type of concealment.
    Iaith wreiddiolSaesneg
    Tudalennau (o-i)281-286
    CyfnodolynDigital Investigation
    Cyfrol10
    Rhif cyhoeddi4
    Dynodwyr Gwrthrych Digidol (DOIs)
    StatwsCyhoeddwyd - 1 Rhag 2013

    Ôl bys

    Gweld gwybodaeth am bynciau ymchwil 'Manipulation of hard drive firmware to conceal entire partitions'. Gyda’i gilydd, maen nhw’n ffurfio ôl bys unigryw.

    Dyfynnu hyn