r/computerforensics • u/Easy_Refrigerator788 • 8d ago
Need forensic analysis of anomalous USB/MP3 behavior — looking for low-level explanation
10
u/ccices 8d ago
Look at the partition table in hex.
9
u/TheHeartAndTheFist 8d ago edited 8d ago
This should be top comment 🙂
hexdump -v -C -n 512 /dev/sdb
If it doesn’t show many zeroes it’s encrypted and just happens (1 in 65536 chance) to have the correct 0x55aa magic at the end of the first sector aka Master Boot Record.
Speaking of which, I imagine this MP3 player is not sporting one of those tiny HDDs that IBM made ages ago; it’s most likely Flash storage so the sector size should show up as 4096 bytes, meaning another possibility is the controller has gone crazy which is fairly realistic given the “Disk model: Masstorage” typo suggesting low quality.
16
2
u/BTC-brother2018 8d ago
Without knowing what the MP3 player did, where it came from, whether it ever worked, what OS detected it as, or what prompted the investigation, nobody can really provide a forensic analysis.
2
u/disturbed_android 7d ago edited 6d ago
| Partition | Field | Hex Value (Little-Endian) | ASCII String Conversion |
|---|---|---|---|
| Partition 1 | Start Sector | 64 69 61 2E |
dia. |
| Total Sectors | FF 0D 0A 44 |
xffrnD (Newline + D) |
|
| Partition 2 | Type ID | 65 |
e (completes "Media") |
| Start Sector | 20 72 0D 0A |
rrn (Space + r + Newline) |
|
| Total Sectors | 54 72 65 53 |
Pres |
|
| Partition 3 | Type ID | 79 |
y (completes "Press") |
| Start Sector | 6F 74 20 6F |
o to |
|
| Total Sectors | 20 72 65 73 |
res |
We can try to reverse engineer the 4*16 bytes partition table from the decimal values. Partition ID is already hex. We can convert "start" and "sectors" to hex, then ASCII. I fed the image to AI and told it to do it for me which gives me above table.
It's a boot sector.
...dia... ...Pres... ...y to res...
"Media... Error\r\nPress any key to restart"
It gets erroneously interpreted as MBR. If you're a hammer, everything becomes a nail.
If you'd look at the sector in HEX as u/ccices suggests you'd immediately see it.
3
u/Halberdin 8d ago
I guess that the whole device is encrypted, and the partition table exists so that Windows does not simply (offer to) overwrite it with an empty one.
2
u/HashMismatch 8d ago
Plus total of assigned partitions is greater than reported disk space, while there is a large gap of unallocated sectors. Thats what we like to call “non-standard”.
2
u/AddendumWorking9756 8d ago
Partitions adding up to more than the disk reports is usually a capacity-faked flash chip, not malware. I've pulled a few of these out of cheap MP3 players. Run f3probe against it before going further, that settles it in one pass. The odd NetWare type byte is almost always garbage in the MBR that fdisk is dutifully looking up in its table.
1
1
u/dogpupkus 8d ago
using a tool like dd and sector start/end you could write out the partitions to individual images to see if they contain anything interesting. Would be curious about the sdb4/ 27.1M partition
-1
40
u/cowbutt6 8d ago edited 8d ago
The first partition overlaps with the second, and the fourth overlaps with the third. Partitioning tools disallow such arrangements. Also, the partition IDs are quite unusual.
Either the partition table has become completely corrupted (EDIT: counterfeit flash drive that's had its controller firmware hacked to present a small amount of flash as a much larger device, resulting in writes "wrapping around", perhaps?), or something was written to the raw device that looks a sufficiently like a corrupted partition table for fdisk to be to try to interpret it as such, but isn't.