Hiding Data in Hard-Drive’s Service Areas

[Nytro]

Hiding Data in Hard-Drive’s Service Areas

Ariel Berkman

<ariel@recover.co.il>

Recover Information Technologies LTD

http://www.recover.co.il

February 14, 2013

Contents

1 Introduction

2 Service Areas and Service Area Modules

3 Service Area Sizes

4 Other Reserved Areas

5 Data Hiding and Sanitation

6 Proof of Concept

7 Summary

1 Introduction

In this paper we will demonstrate how spinning hard-drives’ service areas1

can be used to hide data from the operating-system (or any software using the

standard OS’s API or the standard ATA commands to access the hard-drive).

These reserved areas are used by hard-drive vendors to store modules that in

turn operate the drive, and in a sense, together with the ROM, serve as the

hard-drive’s internal storage and OS. By sending Vendor Specific Commands

(VSCs) directly to the hard-drive, one can manipulate these areas to read

and write data that are otherwise inaccessible. This should not be confused

with DCO2 or HPA3 which can be easily detected, removed and accessed via

standard ATA commands.

Download:

http://www.recover.co.il/SA-cover/SA-cover.pdf