Suppose that the administrator's account is hacked.

Then, can a hacker extract hard disk raw data (by raw data, I mean every raw data, not just files that can be read by a file system.)?

  • Assuming you mean the administrator account was hacked remotely, i don't see anyway in which raw data can be extracted from the hard disk. I might be wrong though. – user10211 Jun 13 '12 at 3:08
  • 4
    What operating system? How is it configured? Usually the answer is yes. – symcbean Jun 13 '12 at 9:41

If an attacker gained administrator rights, he has direct access to hard drive in your computer and, as a result, he can recover any data from it. Just like "real" administrator. So answer to your question is YES.


The short answer is simply: Yes. The longer answer, however, is much more fun. The specifics of how the raw data can be obtained is dependent on your specific infrastructure. First let's take a gander at Linux.

Raw Data Exfiltration in Linux

There is an excellent tool for Linux called 'dd'. It is a program that reads whatever input you specify and makes a block level copy to your output. So take this syntax:

dd if=/dev/sda of=/dev/sdb

That will duplicate all of the data (in 512-byte blocks) from the hard drive sda to the hard drive sdb. From that point the variations are marvelous, and can even be duplicated over the network, say

dd if=/dev/sda | ssh remotehost 'dd of=/dev/sdb'

There are likely many dozens of permutations you could do with dd, but they all result in having an exact duplicate of the source disk. Because of the fact that it is so flexible, I have used it many times during internal forensic investigations. All it requires is read access to the block device that corresponds to the drive you want to copy. Except in very specific circumstances, having root (or administrator) access will grant you this permission.

Raw Data Exfiltration in Windows

The other likely case you're interested in is Windows. It's not something I can get as specific with, since Windows is not my area of expertise, however I do know that the same underlying truth is valid. Administrator access gives you the rights to do this. To reference a commercial product, let's look at EnCase Enterprise.

EnCase is a commercial forensics tool that is widely used in law enforcement. Normally you would run the application on a forensics station that as all the various and sundry bells, whistles, and fiddly bobs necessary to acquire and analyze systems. The Enterprise edition, however, allows one to run the system in a client/server mode. That is, given Administrator privileges on a computer, you install an EnCase agent, and it will make a forensically sound clone of the client machine and store the copy on your server. While this is a commercial solution, it is a specific example of how given Administrator rights on a computer one can make a block level duplicate of the hard drives stored in a remote location. I would not be surprised to hear that there exist free tools to do this.

  • Useless use of dd. You could use cat </dev/sda >/dev/sdb and </dev/sda ssh remotehost 'cat >sda.image'. It would be less error-prone (less risk of inverting input and output) and faster (dd is only faster than cat if you specify a larger block size). – Gilles 'SO- stop being evil' Jun 13 '12 at 14:38
  • 2
    @Gilles: The example given was only for illustration, but sure. Whenever I actually use dd, I always use larger block sizes, and often other options. Not to mention that judicious use of watch and kill -USR1 will give you status updates. Handy feature, that. – Scott Pack Jun 13 '12 at 14:41
  • Ok, pkill -USR1 dd gives a nice format with little typing, but you can get status updates for any command with lsof. Or cat /proc/$pid/fdinfo/1 under Linux. – Gilles 'SO- stop being evil' Jun 13 '12 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.