# Presentation: 337912

## Testing Write Blockers

- James R Lyle
- CFTT Project
- NIST/ITL/SDCT
- November 06, 2006

## DISCLAIMER

**Certain trade names and company products are mentioned in the text or identified. In no case does such identification imply recommendation or endorsement by the National Institute of Standards and Technology, nor does it imply that the products are necessarily the best available for the purpose.**

- Techno Forensics at NIST

- Nov 06, 2006

## Project Sponsors

- NIST/OLES (Program management)
- National Institute of Justice (Major funding)
- FBI (Additional funding)
- Department of Defense, DCCI (Equipment and support)
- Homeland Security (Technical input)
- State & Local agencies (Technical input)
- Internal Revenue, IRS (Technical input)

- Techno Forensics at NIST

- Nov 06, 2006

## Talk Outline

- Software Write Blocking
- Hardware Write Blocking

- Techno Forensics at NIST

- Nov 06, 2006

## Protection Goals

- Prohibit any changes to a hard drive
- Prohibit changes by a malicious program
- Prohibit accidental change (blunder)
- Prohibit change by operating system
- Prohibit damage to a drive

- Techno Forensics at NIST

- Nov 06, 2006

## Protection Strategies

- Standardized & validated procedures
- No Protection software or device
- Trusted OS & trusted tools
- Software write block program
- Hardware write block device

- Techno Forensics at NIST

- Nov 06, 2006

## Software Write Blocking

- Blocking strategies
- Interrupt 0x13 command set
- Command usage observations
- NIST test results for RCMP HDL & Pdblock

- Techno Forensics at NIST

- Nov 06, 2006

## Software Blocking Tools

- BIOS based interrupt 0x13 DOS TSR
- Driver based (e.g., Windows filter stack)
- Built in to OS: Windows XP service pack 2

- Techno Forensics at NIST

- Nov 06, 2006

**Notes:**
Only going to discuss int 0x13 blocking

## Write Block Strategies

- Block unsafe commands, allow everything else
- +	Always can read, even if new command introduced
- Allows newly introduced write commands
- Allow safe commands, block everything else
- +	Writes always blocked
- - Cannot use newly introduced read commands

- Techno Forensics at NIST

- Nov 06, 2006

## Interrupt 0x13 Commands

- 256 possible command codes
- Common BIOS has about 20 defined
- Many obsolete or discontinued commands
- Many commands defined for add on products see http://www.ctyme.com/rbrown.htm

- Techno Forensics at NIST

- Nov 06, 2006

**Notes:**
See Ralph Brown for an extensive list of commands

## Hard Drive BIOS Access

- Techno Forensics at NIST

- Nov 06, 2006

## SWB Tool Operation

- Techno Forensics at NIST

- Nov 06, 2006

## Test Harness Operation

- Techno Forensics at NIST

- Nov 06, 2006

## Phoenix BIOS 4.0

- Techno Forensics at NIST

- Nov 06, 2006

**Notes:**
Defined commands for a common BIOS

## Observations of 0x13 Usage I

- Techno Forensics at NIST

- Nov 06, 2006

**Notes:**
Int 0x13 commands seen using Norton Disk edit, doing a file copy and copying a drive or partition with Safeback
To get the read long command to appear, a drive with a simulated bad sector was required

## Observations of 0x13 Usage II

- Techno Forensics at NIST

- Nov 06, 2006

**Notes:**
The experiment continued with two versions of EnCase for DOS

## Comments on 0x13

- Only two unsafe commands were in use
- Other unsafe commands unlikely to be used
- Format: 05, 06, & 07
- Diagnostic: 0E, 0F, 12, 13, & 14
- Write long: 0B

- Techno Forensics at NIST

- Nov 06, 2006

**Notes:**
The write long has been discontinued
Format command is a low level format not intended for use by user or OS. Really for a “factory setting”

## RCMP HDL & Pdblock

- Techno Forensics at NIST

- Nov 06, 2006

**Notes:**
0.4 – 0.8 are RCMP HDL versions
PDB = pdblock, PDL = pdb_lite
Note HDL 0.4 was written before the 43h command was implemented. 0.4 is safe on a legacy BIOS machine without a SCSI card (The SCSI card might add the 43h cmd to the BIOS).

## Write Blocking Hardware

- Blocking device actions
- ATA standards
- Observed ATA commands
- Device behaviors for two devices

- Techno Forensics at NIST

- Nov 06, 2006

## HWB Testing

- Device

- Send I/O CMD to Device

- Return result to CPU

- BUS1

- BUS 2

- PROTOCOL
-  ANALYZER

- Monitor Bus Traffic

- BUS

- HWB Testing

- HWB

- Techno Forensics at NIST

- Nov 06, 2006

## Write Blocker Actions

- The device forwards the command to the hard drive.
- The blocking device substitutes a different command to the hard drive. The is the case if the blocking device uses different bus protocols for communication with the host and hard drive.
- The device simulates the command without actually forwarding the command to the hard drive.
- If a command is blocked, the device may return either *success* or *failure* for the blocked operation. However, returning *failure* may sometimes cause the host computer to lock up for some commands issued by some operating systems.

- Techno Forensics at NIST

- Nov 06, 2006

**Notes:**
The device forwards the command to the hard drive. 
The blocking device substitutes a different command to the hard drive. The is the case if the blocking device uses different bus protocols for communication with the host and hard drive.
The device simulates the command without actually forwarding the command to the hard drive. For example, the blocking device may already know the size of the hard drive and rather than asking the hard drive again if a request for the size of the hard drive is sent from the host, the device may just return the answer directly to the host.
If a command is blocked, the device may return either success or failure for the blocked operation. However, returning failure may sometimes cause the host computer to lock up for some commands issued by some operating systems.

## ATA Standards

- Techno Forensics at NIST

- Nov 06, 2006

**Notes:**
I may have missed one or two drafts but this gives the general time line.

## Using a Protocol Analyzer

- Techno Forensics at NIST

- Nov 06, 2006

## ATA Write Commands

- Techno Forensics at NIST

- Nov 06, 2006

**Notes:**
Note that commands come and go

## Other Unsafe ATA Cmds

- Techno Forensics at NIST

- Nov 06, 2006

**Notes:**
Must be careful with some of these commands, you can fry a drive with 92h and 50h

## Commands Issued by BIOS

- Techno Forensics at NIST

- Nov 06, 2006

**Notes:**
Used a protocol analyzer to observe what the BIOS does

## Write Commands Issued by OS (Unix)

- Techno Forensics at NIST

- Nov 06, 2006

**Notes:**
Write DMA seems popular

## Write Commands Issued by OS (MS)

- Techno Forensics at NIST

- Nov 06, 2006

**Notes:**
Microsoft keeps evolving

## Blocking Devices vs Writes

- Action by device X and device Y on observed write commands

- Techno Forensics at NIST

- Nov 06, 2006

**Notes:**
Both devices blocked the critical write commands

## Blocking Devices vs Reads

- Actions against observed read commands for two devices: X & Y
- Device Y replaces *read multiple *with *read DMA*

- Techno Forensics at NIST

- Nov 06, 2006

**Notes:**
A => cmd allowed
B => cmd blocked
Hex value => device replaces cmd sent with hex value cmd

## Results for an ATA Device

- The tested device allowed only the following commands:
- 20=READ W/ RETRY
- 24=READ SECTOR EXT
- 25=READ DMA EXT
- 27=RD MAX ADR EXT
- 37=SET MAX ADR EXT (volatile)
- 70=SEEK
- 91=INIT DRV PARAMS
- B1=Device Config
- C8=Read DMA
- F8=RD NATV MAX ADD
- F9=SET MAX ADDRESS (volatile)
- On power on the device issues the following commands to the protected drive:
- EC=IDENTIFY DRIVE
- EF=SET FEATURES
- C6=SET MULTPLE
- EF=SET FEATURES
- C6=SET MULTPLE MOD
- Note that the **identify device** command is blocked if issued by the host, but the device returns the values obtained at power on.

- Techno Forensics at NIST

- Nov 06, 2006

## Another ATA Device

- Although no commands were allowed by the write blocker that could change user or operating system data, some unsupported or atypical commands were allowed. Some examples are:

| Command | Comment |
| --- | --- |
| Down load microcode (0x92) | This command allows reprogramming of hard drive firmware. While this could change drive behavior, the information to do so is drive model specific and not generally available.  |
| Format Track (0x50) | This command is not defined in the current ATA hard drive specifications (ATA-4, through ATA-7). The command was defined in ATA-1, ATA-2 and ATA-3, however all three specifications have been withdrawn. The command could be used to erase information on an older drive that supports the instruction, but could not be used to change the content of any user or operating system data stored on a drive. |
| SMART write (0xB0,D6) | This command records information in a device maintenance log, not part of the data area where data files and operating system data is stored. |
| Vendor Specific commands | These are undocumented commands specific to a given model of hard drive. |
| CFA Erase Erase (0xC0) | This command applies to Compact Flash devices, not hard drives. |
| SATA Write FPDMA (0x61) | This command is noted by the protocol analyzer, but the command is only valid for Serial ATA (SATA) devices. |

- Techno Forensics at NIST

- Nov 06, 2006

## Notable Blocker Behaviors

- allow the volatile SET MAX ADDRESS, block if non-volatile
- cached the results IDENTIFY DEVICE
- substituted READ DMA for READ MULTIPLE
- allowed FORMAT TRACK
- Depending on OS version, might no be able to preview NTFS partition

- Techno Forensics at NIST

- Nov 06, 2006

## Contacts

- Jim Lyle				Doug White
- www.cftt.nist.gov			www.nsrl.nist.gov
- cftt@nist.gov			nsrl@nist.gov
- Barbara Guttman
- bguttman@nist.gov
- Sue Ballou, Office of Law Enforcement Standards
- susan.ballou@nist.gov

- Techno Forensics at NIST

- Nov 06, 2006

**Notes:**
[use if appropriate]