My question is this…does anyone know of a command line or executable that will easily corrupt the firmware or tell the firmware that it is bad? The firmware is the only explanation that I can come up with for the drive having ALL read errors, when the employee just saw the bad guy on the laptop. data on the drive and it does not show any raw-read-error-rate is 0.Īccording to the employee that seized the laptop, the bad guy is very computer savvy and had LOTS of hacking software and 'how to go undetected by the government' documents (unfortunately not seized for my viewing). I have booted to Paladin and attempted to image and again ALL read errors. I've tried to iSCSI to the drive to see what's on it and it freezes my FTK Imager. I connected the HDD to a Forensic Falcon, which sees the drive and all its data (size, serial number, LBA, etc.), but has ALL read errors, from start to end when I try to image it. I know, I know…….Īnyways, now to the lab portion of this. The employee said bad guy typed something in and the screen went black.

The employee that seized the laptop allowed bad guy to have access to the laptop to 'unlock it' for said employee 0 Needless to say, the employee saw the Windows splash screen and then what he described as a black screen with white letter (possibly command line). I have a Toshiba HDD from a laptop that was sent to me for analysis. I have a puzzling case I am working and need your help.

Toshiba mq01abf050 firmware update