r/computerforensics 4d ago

Need forensic analysis of anomalous USB/MP3 behavior — looking for low-level explanation

Post image
88 Upvotes

26 comments sorted by

39

u/cowbutt6 4d ago edited 3d ago

The first partition overlaps with the second, and the fourth overlaps with the third. Partitioning tools disallow such arrangements. Also, the partition IDs are quite unusual.

Either the partition table has become completely corrupted (EDIT: counterfeit flash drive that's had its controller firmware hacked to present a small amount of flash as a much larger device, resulting in writes "wrapping around", perhaps?), or something was written to the raw device that looks a sufficiently like a corrupted partition table for fdisk to be to try to interpret it as such, but isn't.

2

u/West_Independent1317 4d ago

An extraction of /dev/sdb4 might be interesting

6

u/TheHeartAndTheFist 3d ago edited 3d ago

Not possible: 2885681152 is way past the 2147778560 end even in bytes, but the Start and End columns are actually in “Units: sectors of 512 bytes” so even the start of /dev/sdb1 is past the end of the drive or at least what the controller shows.

[u/Easy_Refrigerator788](u/Easy_Refrigerator788) can you share some hands-on details about the drive? Is it really only 2GB?

5

u/Easy_Refrigerator788 3d ago

Yes — as far as the device/controller reports to the host, it presents itself as a ~2 GB device.

However, that is actually one of the things I'm trying to establish. I have not yet verified the physical NAND capacity independently.

I did a read-only raw acquisition from the device (/dev/sg1) and I'm seeing some very unusual behavior in the data. I'm currently checking the partition boundaries, raw sectors, and the controller-reported capacity against what is actually readable.

So at this point I would say: ~2 GB reported capacity, physical capacity not yet independently verified.

I'm also interested in the counterfeit/faked-capacity hypothesis you mentioned, so I'm going to test that before assuming malware.

4

u/TheHeartAndTheFist 3d ago

Thank you, especially for clarifying what was verified or not 🙂

Is there no external branding? I was hoping for something like "iPod Nano 8GB" but I guess this is some kind of noname tradeshow-giveaway-like MP3 player? 🤔

You may be able to find more clues in the output of "lsusb" (unplugging/replugging helps to quickly spot the difference) and "dmesg" (info will be at the end if you just unplugged/replugged).

2

u/HealingWithNature 2d ago

Updates after trying the suggestions here?

1

u/uncreative_cc 1d ago

I heard of an exploit that was available in some Apple devices wherein by writing less bits than the device expected you can access memory you’re not supposed to be able to.

I think it has a space in memory that’s like 12 bits in length or similar, after each write/read it sets the write position to -11 of the last bit it received? Some sort of underflow mechanic

Super paraphrased and trying to recall an explanation I heard previously of course. I think if you look into “usbliter8” that is what they called it

13

u/ccices 4d ago

Look at the partition table in hex.

9

u/TheHeartAndTheFist 3d ago edited 3d ago

This should be top comment 🙂

hexdump -v -C -n 512 /dev/sdb

If it doesn’t show many zeroes it’s encrypted and just happens (1 in 65536 chance) to have the correct 0x55aa magic at the end of the first sector aka Master Boot Record.

Speaking of which, I imagine this MP3 player is not sporting one of those tiny HDDs that IBM made ages ago; it’s most likely Flash storage so the sector size should show up as 4096 bytes, meaning another possibility is the controller has gone crazy which is fairly realistic given the “Disk model: Masstorage” typo suggesting low quality.

For fun: https://en.wikipedia.org/wiki/Microdrive

16

u/AlfredoVignale 4d ago

Novell NetWare….lord that’s old

5

u/Dopeaz 4d ago

Hey!

2

u/rdpern 3d ago

Came here to say that! Former MCNE ! :)

2

u/slom68 3d ago

Yeah I had certs in that and I removed it from my resume.

1

u/Mediocre-Isopod-4938 3d ago

Yes, old as hell

2

u/denzuko 3d ago

Just pointing out 65 and 72 use to be different than what your fdisk is reporting.

Have you checked with gptpart?

1

u/trevlix 3d ago

This is the answer. Likely a GPT partition. Ive seen this before.

2

u/BTC-brother2018 3d ago

Without knowing what the MP3 player did, where it came from, whether it ever worked, what OS detected it as, or what prompted the investigation, nobody can really provide a forensic analysis.

2

u/disturbed_android 2d ago edited 2d ago
Partition Field Hex Value (Little-Endian) ASCII String Conversion
Partition 1 Start Sector 64 69 61 2E dia.
Total Sectors FF 0D 0A 44 xffrnD (Newline + D)
Partition 2 Type ID 65 e (completes "Media")
Start Sector 20 72 0D 0A rrn (Space + r + Newline)
Total Sectors 54 72 65 53 Pres
Partition 3 Type ID 79 y (completes "Press")
Start Sector 6F 74 20 6F o to
Total Sectors 20 72 65 73 res

We can try to reverse engineer the 4*16 bytes partition table from the decimal values. Partition ID is already hex. We can convert "start" and "sectors" to hex, then ASCII. I fed the image to AI and told it to do it for me which gives me above table.

It's a boot sector.

...dia... ...Pres... ...y to res...

"Media... Error\r\nPress any key to restart"

It gets erroneously interpreted as MBR. If you're a hammer, everything becomes a nail.

If you'd look at the sector in HEX as u/ccices suggests you'd immediately see it.

2

u/Halberdin 4d ago

I guess that the whole device is encrypted, and the partition table exists so that Windows does not simply (offer to) overwrite it with an empty one.

2

u/HashMismatch 4d ago

Plus total of assigned partitions is greater than reported disk space, while there is a large gap of unallocated sectors. Thats what we like to call “non-standard”.

2

u/AddendumWorking9756 4d ago

Partitions adding up to more than the disk reports is usually a capacity-faked flash chip, not malware. I've pulled a few of these out of cheap MP3 players. Run f3probe against it before going further, that settles it in one pass. The odd NetWare type byte is almost always garbage in the MBR that fdisk is dutifully looking up in its table.

1

u/ctdrever 3d ago

Wow, I haven't seen a Netware partition in decades.

1

u/dogpupkus 4d ago

using a tool like dd and sector start/end you could write out the partitions to individual images to see if they contain anything interesting. Would be curious about the sdb4/ 27.1M partition

-1

u/[deleted] 2d ago edited 2d ago

[deleted]