Raw hard disk data extraction possible?

Question

Suppose that the administrator's account is hacked.

Then, can a hacker extract hard disk raw data (by raw data, I mean every raw data, not just files that can be read by a file system.)?

Answer 1

If an attacker gained administrator rights, he has direct access to hard drive in your computer and, as a result, he can recover any data from it. Just like "real" administrator. So answer to your question is YES.

Answer 2

The short answer is simply: Yes. The longer answer, however, is much more fun. The specifics of how the raw data can be obtained is dependent on your specific infrastructure. First let's take a gander at Linux.

Raw Data Exfiltration in Linux

There is an excellent tool for Linux called 'dd'. It is a program that reads whatever input you specify and makes a block level copy to your output. So take this syntax:

dd if=/dev/sda of=/dev/sdb

That will duplicate all of the data (in 512-byte blocks) from the hard drive sda to the hard drive sdb. From that point the variations are marvelous, and can even be duplicated over the network, say

dd if=/dev/sda | ssh remotehost 'dd of=/dev/sdb'

There are likely many dozens of permutations you could do with dd, but they all result in having an exact duplicate of the source disk. Because of the fact that it is so flexible, I have used it many times during internal forensic investigations. All it requires is read access to the block device that corresponds to the drive you want to copy. Except in very specific circumstances, having root (or administrator) access will grant you this permission.

Raw Data Exfiltration in Windows

The other likely case you're interested in is Windows. It's not something I can get as specific with, since Windows is not my area of expertise, however I do know that the same underlying truth is valid. Administrator access gives you the rights to do this. To reference a commercial product, let's look at EnCase Enterprise.

EnCase is a commercial forensics tool that is widely used in law enforcement. Normally you would run the application on a forensics station that as all the various and sundry bells, whistles, and fiddly bobs necessary to acquire and analyze systems. The Enterprise edition, however, allows one to run the system in a client/server mode. That is, given Administrator privileges on a computer, you install an EnCase agent, and it will make a forensically sound clone of the client machine and store the copy on your server. While this is a commercial solution, it is a specific example of how given Administrator rights on a computer one can make a block level duplicate of the hard drives stored in a remote location. I would not be surprised to hear that there exist free tools to do this.