Deleting collected digital evidence by exploiting a widely adopted hardware write blocker

Details

Serval ID
serval:BIB_D981B7AFCF62
Type
Article: article from journal or magazin.
Collection
Publications
Title
Deleting collected digital evidence by exploiting a widely adopted hardware write blocker
Journal
Digital Investigation
Author(s)
Meffert Christopher S., Baggili Ibrahim, Breitinger Frank
ISSN
1742-2876
Publication state
Published
Issued date
08/2016
Volume
18
Pages
S87-S96
Language
english
Abstract
In this primary work we call for the importance of integrating security testing into the process of testing digital forensic tools. We postulate that digital forensic tools are increasing in features (such as network imaging), becoming networkable, and are being proposed as forensic cloud services. This raises the need for testing the security of these tools, especially since digital evidence integrity is of paramount importance. At the time of conducting this work, little to no published anti-forensic research had focused on attacks against the forensic tools/process. We used the TD3, a popular, validated, touch screen disk duplicator and hardware write blocker with networking capabilities and designed an attack that corrupted the integrity of the destination drive (drive with the duplicated evidence) without the user’s knowledge. By also modifying and repackaging the firmware update, we illustrated that a potential adversary is capable of leveraging a phishing attack scenario in order to fake digital forensic practitioners into updating the device with a malicious operating system. The same attack scenario may also be practiced by a disgruntled insider. The results also raise the question of whether security standards should be drafted and adopted by digital forensic tool makers.
Keywords
Digital forensics, Digital forensic tool testing, Hardware write blocker, Root access, Anti-Forensics, Vulnerability, Frameworks, Gismo, NIST, TD3
Web of science
Open Access
Yes
Create date
06/05/2021 11:01
Last modification date
06/05/2021 11:42
Usage data