| 1. |
- Alendal, Gunnar, et al.
(författare)
-
Exploiting Vendor-Defined Messages in the USB Power Delivery Protocol
- 2019
-
Ingår i: Advances in Digital Forensics XV. - Cham : Springer. - 9783030287511 - 9783030287528 ; , s. 101-118
-
Konferensbidrag (refereegranskat)abstract
- The USB Power Delivery protocol enables USB-connected devices to negotiate power delivery and exchange data over a single connection such as a USB Type-C cable. The protocol incorporates standard commands; however, it also enables vendors to add non-standard commands called vendor-defined messages. These messages are similar to the vendor-specific commands in the SCSI protocol, which enable vendors to specify undocumented commands to implement functionality that meets their needs. Such commands can be employed to enable firmware updates, memory dumps and even backdoors.This chapter analyzes vendor-defined message support in devices that employ the USB Power Delivery protocol, the ultimate goal being to identify messages that could be leveraged in digital forensic investigations to acquire data stored in the devices.© IFIP International Federation for Information Processing 2019
|
|
| 2. |
- Gray, Struan, 1965-, et al.
(författare)
-
Digital Forensic Atomic Force Microscopy of Semiconductor Memory Arrays
- 2019
-
Ingår i: Advances in Digital Forensics XV. - Cham : Springer. - 9783030287528 - 9783030287511 ; , s. 219-237
-
Konferensbidrag (refereegranskat)abstract
- Atomic force microscopy is an analytical technique that provides very high spatial resolution with independent measurements of surface topography and electrical properties. This chapter assesses the potential for atomic force microscopy to read data stored as local charges in the cells of memory chips, with an emphasis on simple sample preparation (“delidding”) and imaging of the topsides of chip structures, thereby avoiding complex and destructive techniques such as backside etching and polishing. Atomic force microscopy measurements of a vintage EPROM chip demonstrate that imaging is possible even when sample cleanliness, stability and topographical roughness are decidedly sub-optimal. As feature sizes slip below the resolution limits of optical microscopy, atomic force microscopy offers a promising route for functional characterization of semiconductor memory structures in RAM chips, microprocessors and cryptographic hardware. © IFIP International Federation for Information Processing 2019. Published by Springer Nature Switzerland AG 2019
|
|
| 3. |
- Karresand, Martin, et al.
(författare)
-
Creating a Map of User Data in NTFS to Improve File Carving
- 2019
-
Ingår i: Advances in Digital Forensics XV. - Cham : Springer. - 9783030287528 - 9783030287511 ; , s. 133-158
-
Konferensbidrag (refereegranskat)abstract
- Digital forensics, and espesially, file carving are burdened by the large amounts of data that need to be processed. Attempts to solve this problem include efficient carving algorithms, parallel processing in the cloud and data reduction by filtering uninteresting files. This research addresses the problem by searching for data wher it is more likely to be found. This is accomplished by creating a probability map for finding unique data at various logical block addressing positions in storage media. SHA-1 hashes of 512B sectors are used to represent the data. The results, which are based on a collection of 30 NTFS partitions from computers runnign Microsoft Windows 7 and later versions, reveal that the mean probability of finding unique hash values at different logical block addressing positions vary between 12% and 41% in an NTFS partition. The probability map can be used by forensic analyst to prioritize relevant areas in storage media without the need for a working filesystem. It can also be used to increase the efficienty of hash-based carving by dinamically changing the random sampling frequency. The approach contributes to digital forensic processes by enabling them to focus on interesting regions in storage media, increasing the probability of obtaining relevant results faster. © IFIP International Federation for Information Processing 2019
|
|
