期刊文献+

一种通过硬盘串口获取固件工厂指令的方法

Acquisition of hard drive disk firmware factory commands based on serial interface mode
下载PDF
导出
摘要 硬盘固件是控制硬盘存取行为的核心部件,通过硬盘固件指令能够实现对数据的高效访问,是实现电子证据提取和数据恢复的有效手段。硬盘固件直接影响硬盘使用体验,一直是厂家严格保护的商业机密,获取硬盘固件的相关信息异常困难,尤其对于高市场占有率的希捷硬盘,尚无资料说明存在工具和方法能够对其硬盘固件区实现完全控制。通过逆向分析官方硬盘固件升级包文件,给出基于串口模式控制指令测试重构硬盘固件指令集的方法,并通过实验验证其可行性,此方法可服务于硬盘固件结构黑盒分析和电子数据证据获取。 Hard disk firmware is the core component to control the access behavior of hard disk. It can access data efficiently through firmware instruction of hard disk. It is an effective means to extract electronic evidence and restore data. The firmware of the hard disk directly affects the user experience, and has always been a strictly protected commercial secret of the manufacturer. It is extremely difficult to obtain relevant information about the firmware of the hard disk, especially for the brand with a high market share, Seagate. There is no data on the existence of and tools and methods to achieve complete control of its hard disk firmware area. By reverse analyzing the official firmware upgrade package files, a method that can test and refactor firmware instruction set based on serial interface mode control instruction has been proposed, and the feasibility of this method is verified by experiments. This method can be used for hard disk firmware structure black box analysis and digital data evidence acquisition.
作者 赵露 康艳荣 刘思棋 龙源 郭丽莉 ZHAO Lu;KANG Yanrong;LIU Siqi;LONG Yuan;GUO Lili(Institute of Forensic Science,Ministry of Public Security PRC,Beijing 100038,China;Beiya Anshu Technology Co.,Ltd,Beijing 100094,China)
出处 《西安邮电大学学报》 2018年第4期105-110,共6页 Journal of Xi’an University of Posts and Telecommunications
基金 公安部物证鉴定中心基本科研业务费专项资金项目(2018JB005)
关键词 希捷硬盘 硬盘固件 工厂指令 串口模式 Seagate hard drive firmware factory command serial interface mode
  • 相关文献

参考文献5

二级参考文献38

共引文献18

相关作者

内容加载中请稍等...

相关机构

内容加载中请稍等...

相关主题

内容加载中请稍等...

浏览历史

内容加载中请稍等...
;
使用帮助 返回顶部