I suspect that both my HDD and SSD may be infected. Is it possible to take an image of the firmware? How do I go about doing it?

  • Not sure if this is still true, but a few years ago EnCase was the clear market leader. Wikipedia has a list of digital forensics tools – paj28 Oct 29 '18 at 14:02
  • 1
    From Seagate on the topic of firmware: "External, Serial ATA, and ATA drives are not designed for field firmware updates by end users." knowledge.seagate.com/articles/en_US/FAQ/206091en This would lead me to believe there are no public interfaces and probably require special tools (e.g. firmware flash from a proprietary connector and/or accessible by disassembling the body). I don't know this though. – thepip3r Oct 29 '18 at 15:00
  • 1
  • 1
    I fail to see how this is off-topic. It is not asking for a specific product, but a technique. If it were "tell me what SPI programmer I should get", then I would agree, but this is just asking about how to do forensic analysis on drive firmware. – forest Oct 30 '18 at 1:20
  • 1
    Ah, now I understand. This was closed when it was phrased poorly, asking for a tool. It seems to have been edited to no longer request products and is instead asking if it's possible and what techniques should be used. This edit seems to have made it on-topic (voting to re-open). – forest Oct 30 '18 at 3:21

There is a standard to write firmware, the ATA DOWNLOAD_MICROCODE command and the segmented version (transfer protocol 3), but there is no standard for reading the firmware back. As another answer says, some manufacturers may add their own vendor-specific techniques to do so.

There is another reliable way to access firmware, but it cannot be done from software. Opening the drive to see the controller will expose the firmware chip (flash or EEPROM) which can be read directly using specialized hardware designed to interface with the chip, such as a SPI reader. Sometimes, the controller chip has internal flash, meaning there is no external chip to read, which would mean attaching a JTAG probe to the chip is the likely solution to obtaining the firmware.

There are two excellent resources showing what it takes to read the firmware so it can be modified and replaced which I know of. Specifically, an incomplete (?) write-up on HDD firmware-based MBR rootkits from Malwaretech and the classic Linux port to an HDD by SpritesMods. An image from the latter showing the flash chip which you'd need to directly interface with to read is below.

Image of flash chip from an HDD


There aren't tools readily available to read/dump a SSD firmware (except for a few specific cases). Each manufacturer implements their hardware and firmware however they want. This means there's no standard protocol to dump a SSD firmware.

The only way we get a tool to dump a specific vendors firmware is if they release it, or someone reverse engineers one. Reverse engineering a firmware dumper can be difficult, and doesn't necessarily apply to all drives from a manufacturer since they could change chipsets, or protocols for firmware interaction on new models at any time.

  • 1
    There is a standard to update firmware, although I suppose some manufacturers might avoid it and use a non-standard technique. But the ATA command set absolutely includes a standard which is commonly used. – forest Oct 29 '18 at 21:43
  • @forest what standard is that? – Daisetsu Oct 29 '18 at 21:44
  • 1
    The ATA command set, specifically DOWNLOAD_MICROCODE and the segmented version. Also it seems like all the upgrade guide links you provided use that technique, just with their own custom software frontend. You could just as well do it all with hdparm, which should support all of those. – forest Oct 29 '18 at 21:45
  • 1
    Thanks, great to learn new stuff. I edited to clarify that. – Daisetsu Oct 29 '18 at 21:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.