The Impact of Hard Disk Firmware Steganography on Computer Forensics

Sutherland, Iain; Davies, Gareth; Pringle, Nick; Blyth, Andrew

doi:10.15394/jdfsl.2009.1059

Cited by 3 publications

(2 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Du, Ledwith and Scanlon (2018) further back up Laurenson (2016) and compared several forensic tools, finding that they did not scan the firmware of disks. Sutherland et al (2009) used well-known forensic software Encase, FTK and AccessData. They found that changing the error lists in the firmware was not detected by any of the software tested.…”

Section: Attacks Against Forensics Tools and Processesmentioning

confidence: 99%

Forensic Trails Obfuscation and Preservation via Hard Drive Firmware

Underhill

Oyinloye²,

Speakman³

et al. 2022

eccws

View full text Add to dashboard Cite

The hard disk drive stores data the user is creating, modifying, and deleting while a firmware facilitates communication between the drive and the operating system. The firmware tells the device and machine how to communicate with each other and will share useful information such as, disk size and information on any bad sectors. Current research shows that exploits exist that can manipulate these outputs. As an attacker, you can change the size of the disk displayed to the operating system to hide data in, likewise by marking an area of the disk as bad. Users may not be aware of these changes as the operating system will accept the readings from the firmware. However, although the data is not reachable via the operating system this paper looks at the traceability of manipulated data using data recovery software FTK Imager, Recuva, EaseUS and FEX Imager. This report examines the use of malicious techniques to thwart digital forensic procedures by manipulating the firmware. It is shown how this is possible and current forensic techniques or software does not easily detect a change within the firmware. However, with the use of various forensic tools, obfuscated trails are detectable. This report follows a black box testing methodology to show the validation of forensic tools or software against anti-forensic techniques. The analysis of the results showed that most tools can find the firmware changes, however, it requires an analyst to spot the subtle differences between standard and manipulated devices. The use of multiple software tools can help an analyst spot the inconsistencies.

show abstract

Section: Attacks Against Forensics Tools and Processesmentioning

confidence: 99%

Forensic Trails Obfuscation and Preservation via Hard Drive Firmware

Underhill

Oyinloye²,

Speakman³

et al. 2022

eccws

View full text Add to dashboard Cite

show abstract

“…Any flaws identified on the drive during production are recorded in the disk firmware as the 'P' (primary, production or permanent) list. As the disk ages and as a result of wear & tear other sectors fail and this is recorded within the firmware area in the 'G' (growth) list [6,7]. Reads and writes are automatically redirected (remapped) to spare sectors within the Reserved Area (see Fig.…”

Section: Hard Drive Firmware Functionalitymentioning

confidence: 99%

Malware and steganography in hard disk firmware

2011

Self Cite

View full text Add to dashboard Cite

The hard disk drive remains the most commonly used form of storage media in both commercial and domestic computer systems. These drives can contain a vast range of data both of personal value and commercial significance. This paper focuses on two key areas; the potential for the drive operation to be impacted by malicious software and the possibility for the drive firmware to be manipulated to enable a form of steganography. Hard drive firmware is required for the correct operation of the disk drive in particular for dealing with errors arising due to natural wear as the drive ages. Where an area of the drive becomes unreliable due to wear and tear, the disk firmware which monitors the reliability of data access will copy the data from the failing area to a specially designated reserved area. The firmware remaps this data shift so the old data area and the original copy of the data are no longer accessible by the computer operating system. There are now a small number of commercially available devices, intended for data recovery, which can be used to modify the hard drive firmware components. This functionality can be used to conceal code on the disk drive, either as a form of steganography or to potentially include malicious code with the intention to infect or damage software or possibly system hardware. This paper discusses the

show abstract