united-states software open-source-software digital-forensics
Publishing anti-forensic hard drive firmware
<p>Forensic write-blockers, such as the <a href="https://en.wikipedia.org/wiki/File:Tableau_TD3_Forensic_Imager_2014-06-26_07-05.jpg" rel="nofollow noreferrer">TD3</a>, sequentially copy data from one hard drive to a second drive (&quot;cloning&quot; the drive) while preventing the first hard drive from receiving any write commands. This is done in order to avoid the claim that the evidence was modified during the cloning process.</p>
<p>Hard drives contain firmware that determine their behavior and in some cases this firmware can be modified. What laws influence whether or not an individual can publish modified firmware and installation instructions for a hard drive which causes it to initiate an internal erasure upon detection of drive cloning? What laws influence whether or not another individual can <em>use</em> said firmware?</p>
<hr />
<p>Consider the following hypothetical scenario: Alice creates this modified anti-forensic firmware and publishes it in open source form. Bob puts this firmware on his hard drive. Some time later, Bob's computer is confiscated by police. Rather than physically removing the individual platters within the drive and putting them in a drive whose firmware they control (an expensive and risky process), a forensics lab simply attaches a write-blocker and attempts to clone it. The hard drive firmware detects the cloning in progress and initiates an automated erasure, destroying the only copy of evidence.</p>
<p>Assume neither Alice nor Bob did this specifically with the intent of interfering with lawful digital forensics processes. Alice published this because it was a cool proof-of-concept she had made, and Bob installed it to prevent thieves from copying his hard drive. The firmware has no way to distinguish between cloning the drive for illicit purposes and lawful collection of evidence with a write-blocker.</p>

<p>To the best of my knowledge, there is no US federal law prohibiting either the writing or the installation of such &quot;anti-cloning&quot; firmware, any more than the law compels you not to but a lock on your door or install a safe. Whether such firmware would be effective or not is not a legal question. Neither is there any law prohibiting encrypting a drive. Indeed  a law forbidding encryption would probably be unconstitutional under the First Amendment.</p>
<p>If a court subpoenaed Bob's computer, Bob might well be obligated to warn of such protective firmware, or be held responsible for destruction of evidence.</p>
