Hacker News new | ask | show | jobs
by rtkwe 3194 days ago
That's unlikely to work. Police forensics usually work with a drive image instead of with the device itself as much as possible to avoid damaging evidence either through allowing active measures like a dead mans switch or mishandling by investigators.

Beyond that simply removing the dive and putting it in another computer would bypass any switch except one in the drive firmware itself. Are there any software out there designed to do that?
2 comments
angry_octet 3194 days ago
Not feasible with iPhones, as it is not possible to access the security processor memory. At least, not without some very sophisticated attack, e.g. using some sort of differential power analysis on the chip. Very expensive.
link
amiga-workbench 3194 days ago
What do they do with devices that have soldered in storage?

Hilariously enough, an Intel Management Engine-esque system could come in handy here for nuking data.

link
rtkwe 3194 days ago
Not sure. Last time I read about these things soldered in storage wasn't really a thing. For some things where it's still largely a separate board they could probably just desolder it and attach it to another device via pogo pins or something. For monolithic boards you could attach wires directly to the chip given enough resources.

IME could maybe be useful for this but it's hard to prevent the take the drive out and attach it to another machine without having firmware or a ME-like chip on the drive to make it wipe if it's connected to a different machine.

link
subroutine 3193 days ago
Doesnt every new Macbook Pro have a soldered-in SSD?
link
rtkwe 3193 days ago
Yes though in this [0] teardown there's a comment at the bottom that makes it sound like there's an easy connector where the SSD CPU connection can be accessed which would probably allow non-destructive imaging without involving the CPU so no userland software could protect against imaging.

> The funny connector to nowhere is the connector to tap into the SSD. When the Apple connector is mounted (as supplied) it connects the CPU to the SSD. When removed the signals for the SSD can be accessed.

[0] https://www.ifixit.com/Teardown/MacBook+Pro+13-Inch+Touch+Ba...

link
mmel 3194 days ago
They desolder it and resolder it into a platform to read it
link