2

Forensic write-blockers, such as the TD3, sequentially copy data from one hard drive to a second drive ("cloning" the drive) while preventing the first hard drive from receiving any write commands. This is done in order to avoid the claim that the evidence was modified during the cloning process.

Hard drives contain firmware that determine their behavior and in some cases this firmware can be modified. What laws influence whether or not an individual can publish modified firmware and installation instructions for a hard drive which causes it to initiate an internal erasure upon detection of drive cloning? What laws influence whether or not another individual can use said firmware?

Consider the following hypothetical scenario: Alice creates this modified anti-forensic firmware and publishes it in open source form. Bob puts this firmware on his hard drive. Some time later, Bob's computer is confiscated by police. Rather than physically removing the individual platters within the drive and putting them in a drive whose firmware they control (an expensive and risky process), a forensics lab simply attaches a write-blocker and attempts to clone it. The hard drive firmware detects the cloning in progress and initiates an automated erasure, destroying the only copy of evidence.

Assume neither Alice nor Bob did this specifically with the intent of interfering with lawful digital forensics processes. Alice published this because it was a cool proof-of-concept she had made, and Bob installed it to prevent thieves from copying his hard drive. The firmware has no way to distinguish between cloning the drive for illicit purposes and lawful collection of evidence with a write-blocker.

Improve this question
8
  • Note that, from the source drive's perspective, it doesn't know about the write-blocking, just that it's received read commands. Creating such firmware is problematic from that, since you'd need to be careful what a "copy threshold" would be set at (you couldn't duplicate your drive, for example). From an evidentiary perspective, turning over such a drive (as opposed to having it seized) likely would constitute destruction of evidence (a separate crime). Also, the better way to prevent unwanted copying is to encrypt the drive, which many drives do natively (and is managed by the OS)
    – Clockwork-Muse
    Commented Feb 14, 2021 at 23:53
  • @Clockwork-Muse It's not particularly difficult to detect cloning in place while minimizing false positives. For example, if the drive is powered up and n sectors are read sequentially without any seeks, then it's being cloned. If instead it gets lots of random reads and some writes, then it knows that everything is fine even if later it does get sequential read requests. As for encryption, it only helps if you don't reveal the password. A thief might force you to give up the password. Likewise in law, there are instances where you can be compelled to reveal your password.
    – forest
    Commented Feb 14, 2021 at 23:56
  • If a thief (or the law) is compelling you to provide a password, both will be equally as displeased when the drive destructs. Encryption prevents any files leaking, while this needs some read threshold, allowing at least some files to be read. Note that, since reads are normally nondestructive, there may be more reads on a system than you realize. For instance, the OS indexing the drive for faster searching. Depending on what data the drive contains, it might not be unlikely that a grep (search file contents) is performed.
    – Clockwork-Muse
    Commented Feb 15, 2021 at 0:34
  • the trivial detection method you propose is easily subverted by randomizing the order of reads, but i realize that's a cat-n-mouse game.
    – grovkin
    Commented Feb 15, 2021 at 0:40
  • 3
    @Clockwork-Muse Sure, and I'm not dissing encryption or encouraging anything less. The actual implementation of such anti-forensic firmware and whether or not it is practical is out-of-scope (there have been various PoCs from time to time, including one that used an iPod Classic hard drive!). Since I asked this question on Law.SE, I figured I would only need to provide the most basic description of the system, not a more full "production ready" description that goes into all the edge cases.
    – forest
    Commented Feb 15, 2021 at 0:46

1 Answer 1

Reset to default
2

To the best of my knowledge, there is no US federal law prohibiting either the writing or the installation of such "anti-cloning" firmware, any more than the law compels you not to but a lock on your door or install a safe. Whether such firmware would be effective or not is not a legal question. Neither is there any law prohibiting encrypting a drive. Indeed a law forbidding encryption would probably be unconstitutional under the First Amendment.

If a court subpoenaed Bob's computer, Bob might well be obligated to warn of such protective firmware, or be held responsible for destruction of evidence.

Improve this answer
6
  • Interesting. So Bob is required to disclose the existence of protective software? Isn't that compelled speech? I would understand that Bob would get in trouble if he handed the drive to the police and told them they're free to clone it. Where is the line drawn, then? Would one need to tell police if their computer will shut off if the wrong password is input too many times, or if an encrypted laptop will turn off if closed? Assume that the protection mechanisms were not designed specifically to evade police or to hinder an investigation, which would of course be illegal no matter what.
    – forest
    Commented Mar 22, 2022 at 22:45
  • @forest I do not think there are specific laws covering these various contingencies. The law says that a person may not knowingly destroy evidence, and particularly that when served with a court order onemust hand ofer the items sought without destroying them. Trickign the authorities into doign the destruction for you is a way of destroying the evidence sought. If the protective measure does not destroy the evidence, this rule probably does not come into play.
    – David Siegel
    Commented Mar 22, 2022 at 22:53
  • There are very many common systems now which may be considered destroying evidence. Handing over a locked phone, knowing that it will turn off if the wrong password is input too many times, will cause it to be even harder to open due to encryption. Perhaps my understanding of "tricking authorities" is incorrect, because I am under the impression that that requires intent. Should I post a separate question about automated but active anti-theft measures (non-harmful "booby traps" intended to protect from thieves), or is there already an existing question on the site?
    – forest
    Commented Mar 22, 2022 at 22:54
  • @forest "turn off" is not the same as "self erase". Only when the person turning the device over knows (or should know) that a plausible course of action will result in the permanent destruction of evidence would the warning be required, I think. But that would be an issue if the person were separately charged with destruction of evidence. I don't know of caselaw clearly on point here.
    – David Siegel
    Commented Mar 22, 2022 at 22:58
  • 1
    From this answer: In a criminal case, where you are a defendant, you have an absolute right to not incriminate yourself and do not have to take affirmative action to preserve evidence, although this right is limited to criminal cases and your failure to preserve evidence can still be held against you in a civil case.
    – forest
    Commented Mar 22, 2022 at 23:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .