자기 암호화 저장장치의 은닉 영역에 대한 포렌식 분석

Abstract

This paper focuses on the hidden areas of self-encrypting drives (SEDs) that comply with the Trusted Computing Group (TCG) storage specification. In general, data storage devices include not only areas accessible via standard read and write commands provided to end-users but also hidden areas such as the Host Protected Area (HPA) and Device Configuration Overlay (DCO), which are inaccessible through conventional commands. These hidden areas may not be detectable by standard industrial tools, posing potential security risks to digital forensic investigators and corporate security administrators. The existence of such hidden areas significantly increases the risk that a forensic image of the storage device may not represent a true physical copy, potentially leading to incomplete or inaccurate investigative results due to concealed data. Moreover, data residing in these areas may persist despite deletion procedures carried out using typical industrial tools, resulting in the retention of sensitive information. This paper introduces the unique hidden areas present in self-encrypting drives compliant with the TCG storage specification. It further demonstrates, through the use of open-source and freely available tools, that users can access, modify, and write data within these hidden regions. Finally, the paper discusses the potential implications of these hidden areas in digital forensic investigations and proposes corresponding countermeasures.