# Presentation: 337917

## Testing BIOS Interrupt 0x13 Based Software Write Blockers

- Paul E. Black, Ph.D.
- James R. Lyle, Ph.D.
- National Institute of Standards and Technology
- _[http://www.nist.gov/](http://www.nist.gov/)_

## DISCLAIMER

- Certain trade names and company products are mentioned in the text or identified. In no case does such identification imply recommendation or endorsement by the National Institute of Standards and Technology (NIST), nor does it imply that the products are necessarily the best available for the purpose.** **

- Paul E. Black

## Outline

**Computer Forensics at NIST**
**Software Write Block Programs**
**Hardware Write Block Devices**
**Results**

- Paul E. Black

## NIST Computer Forensic Goals

**Establish methodology for testing computer forensic tools (CFTT)**
**Hard drive imaging tools**
**Software & hardware hard drive write blockers**
**Deleted file recovery**
**String searching**
**Provide international standard reference data for files (NSRL)**
**Operating system files**
**Common applications**
**Voting software**

- Paul E. Black

## Hard Drive Write Protect

**Can be done either with hardware or software**
**Software write protection is limited to specific environment: BIOS access or device driver**
**Hardware write protection is more general**

- Paul E. Black

## Computer Forensics at NIST
Software Write Block Programs
Hardware Write Block Devices
Results

**Software Write Block Programs**
**Hardware Write Block Devices**
**Results**

- Paul E. Black

## SW Write Blocker Requirements

**Informal**
**No change allowed to a drive that contains evidence**
**Must allow the entire drive to be read**
**More Formally**
**(1) ****The tool shall block any commands to a protected disk in the write, configuration, or miscellaneous categories.**** **
**(2) The tool shall not block any commands to a protected disk in the read, control, or information categories****.**

- Paul E. Black

## Disk access via BIOS Int 0x13

- Paul E. Black

## Disk access with SWB program

- Paul E. Black

## Flow to test SWB program

- Paul E. Black

## RCMP HDL & Pdblock

- Paul E. Black

**Notes:**
0.4 – 0.8 are RCMP HDL versions
PDB = pdblock, PDL = pdb_lite
Note HDL 0.4 was written before the 43h command was implemented. 0.4 is safe on a legacy BIOS machine without a SCSI card (The SCSI card might add the 43h cmd to the BIOS).

## Computer Forensics at NIST
Software Write Block Programs
Hardware Write Block Devices
Results

**Software Write Block Programs**
**Hardware Write Block Devices**
**Results**

- Paul E. Black

## Disk access via BIOS Int 0x13

- Paul E. Black

## Disk access, detailed view

- driver

- Paul E. Black

## Disk access with HWB

- allow

- return

- block

- driver

- Paul E. Black

## Flow to test HWB device

- return

- block

- driver

- Protocol
- Analyzer

- Protocol
- Analyzer

- allow

- Paul E. Black

## Computer Forensics at NIST
Software Write Block Programs
Hardware Write Block Devices
Results

**Software Write Block Programs**
**Hardware Write Block Devices**
**Results**

- Paul E. Black

## Impact

**Release 18 (Feb 2001) - A US government organization was doing some testing and uncovered an issue under a specific set of circumstances. **
**Linux doesn’t use the last sector if odd**
**Several vendors have made product or documentation changes**
**CFTT cited in some high profile court cases**

- Paul E. Black

## Specifications

**Available**
**Hard Drive Imaging (e.g., Safeback, EnCase, Ilook, Mares imaging tool)**
**Revised Hard Disk Imaging (Digital Data Acquisition)**
**Software Write Block Programs (e.g., RCMP HDL, Pdblock, ACES)**
**Hardware Write Block Devices (A-Card, FastBlock, NoWrite) – posted for public review**
**Deleted File Recovery**
**Under Development**
**Revised Hard Disk Imaging – Test Plan**
**Deleted File Recovery – Test Plan**
**String Searching**

- Paul E. Black

## Test Reports

**Available**
**Sydex SafeBack 2.0**
**NTI Safeback 2.18**
**EnCase 3.20**
**GNU dd 4.0.36 (RedHat 7.1)**
**FreeBSD 4.4 dd **
**RCMP HDL V0.4, V0.5, V0.7, & V0.8**
**In Progress**
**Pdblock 2.0**
**Pdblock 2.1**
**Pdblock lite**

- Paul E. Black

## Contacts

**Jim Lyle****	****	****	****	****Doug White**
**www.cftt.nist.gov****	****	****	****www.nsrl.nist.gov**
**cftt@nist.gov****	****	****	****	****nsrl@nist.gov**
**Mark Skall**
**Chief, Software Diagnostics & Conformance Testing Div.**
**www.itl.nist.gov/div897****	****	****skall@nist.gov**
**Sue Ballou, Office of Law Enforcement Standards**
**Steering Committee Rep. For State/Local Law Enforcement**
**susan.ballou@nist.gov **

- Paul E. Black