Re: Article - Hiding Data in Hard Disk Firmware (Service Area)

gn47isrg · 2016-07-25T10:50:57Z

Re Hiding Data from Forensic Imagers – Using the Service Area of a Hard Disk DriveBy Todd G. Shipley and Bryan Door, July 2016.Further Free Information & Support Available.If you were interested in this article please read on.Device Firmware Manipulation & Digital Steganography Techniques for HDD and Nand Flash memory technologies.It may benefit the community to know that this type of research has been underway for the past 6 years at the University of South Wales, UK. In that time we have published a number academic research papers, given talks at conferences, and provided free training covering this subject in detail and how it could affect some types of investigations - This work, like all our forensic data recovery research, is being done for the benefit of the law enforcement community and as such is freely available to those in said community who are in needFull papers available in the public domain on this particular subjectRead H., Sutherland I., Xynos K., Davies G., (2013), Caveat Lector What is the true Nature of a disk drive, Proceedings of the Digital Investigator Journal, Published 2014.Huw Read, Konstantinos Xynos, Iain Sutherland, Gareth Davies, Tom Houiellebecq, Frode Roarson, Andrew Blyth, Manipulation of hard drive firmware to conceal entire partitions, Digital Investigation, Volume 10, Issue 4, December 2013.Sutherland I., Davies G., Blyth A., (2011) Malware and Steganography in Hard Disk Firmware. Springer Journal, Computer Virology, January, pp. 1-5.Davies G., Sutherland I., (2010), Hard Disk Storage Firmware Manipulation and Forensic Impact; Current Best Practice, The 2010 ADFSL Conference on Digital Forensics, Security and Law, St. Paul, Minnesota, USA on May 19-21, 2010.Presentations / PodcastsICDDF. Device Firmware Manipulation and Data Recovery Techniques. 2015.F3. UK First Forensic Forum Conference – Invited speaker, NAND Memory Digital Forensics / Hard Disk Firmware Manipulation and Data Recovery Presentation, 2011/12 ADFSL. HDD Service Area Data Recovery workshop Current Best Practice, The 2012 ADFSL Conference on Digital Forensics, Security and Law, Virginia, USA on May, 2012.Forensic 4cast. Podcast episode 40 Data storage manipulation. 2011.44Con. Information Security Practitioners Conference 2011.This area of research is a primary thread in our research focus and has in recent years addressed and progressed firmware manipulation and data recovery techniques for Hard Disk and NAND Flash Memory Technologies.If you are active law enforcement and this area is of concern or interest to you please get in contact with The Information Security Research Group, Cyber Forensics Research Division, University of South Wales, UK. at the following address isrg1@southwales.ac.ukThank you.

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by MDCR 9 years ago

11 Posts

4 Users

0 Reactions

1,644 Views

RSS

MDCR

(@mdcr)

Reputable Member

Joined: 15 years ago

Posts: 376

29/07/2016 10:47 pm

It is honourable to recognise / reference research inspirations. I would like to highlight this white paper from 2005. Thank you Arne Vidström!

http//www.cse.scu.edu/~tschwarz/coen252_07/Resources/foi-computer-forensics.pdf

Thank you.

Very good indeed, i remember his earlier work on ntsecurity.nu.

-"It is very important to test how forensic imaging and disk wiping tools handle HPA and DCO before using them"

About this I tried an imager just a few years ago that "lit up a diode if HPA was detected". Cant remember the manufacturer, but i skipped it since it wasn't very useful…

ReplyQuote

Page 2 / 2 Prev

8 Forums
15.7 K Topics
92.3 K Posts
235 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed