Why is firmware important to forensic investigations

No Current Special Offers. Abstract The introduction of a wireless gateway as an entry point to the automobile in-vehicle network reduces the effort of performing diagnostics and firmware updates considerably. Unfortunately, the same gateway also allows cyber attacks to target the unprotected network which currently lacks proper means for detecting and investigating security-related events.

In this article, we discuss how to perform a digital forensic investigation of an in-vehicle network. An analysis of the current features of the network is performed, and an attacker model is developed. Based on the attacker model and a set of generally accepted forensic investigation principles, we derive a list of requirements for detection, data collection, and event reconstruction.

We then use the Integrated Digital Investigation Process proposed by Carrier and Spafford as a template to illustrate how our derived requirements affect an investigation. Further, not all drives have the ability to use jumpers. The second two bullet points refer to software and hardware write blockers.

A write blocker is any tool that permits read-only access to data storage devices without compromising the integrity of the data. A write blocker, when used properly, can guarantee the protection of the data chain of custody. Software and hardware write blockers do the same job. They prevent writes to storage devices. The main difference between the two types is that software write blockers are installed on a forensic computer workstation, whereas hardware write blockers have write blocking software installed on a controller chip inside a portable physical device.

Abstract Tracking storage devices is one of the important fields in digital forensics. Access to Document Link to publication in Scopus. Link to the citations in Scopus. Fingerprint Dive into the research topics of 'Forensic signature for tracking storage devices: Analysis of UEFI firmware image, disk signature and windows artifacts'.

Together they form a unique fingerprint. View full fingerprint. Digital Investigation , 29 ,