File Systems for Electronic Surveillance Devices?

An anonymous reader asks: "A friend recently discovered that her vehicle had been bugged by the police (for reasons I won't go into here). It seems the set-up had been wired into the car's electronics, so that whenever the car was going the microphones were recording the occupants' conversations. Unfortunately I didn't get to see everything she recovered, as she was a bit exuberant in her removal and disposal. However, I have been given a 20G Fujitsu notebook hard drive and some kind of audio processing chip from a manufacturer by the name of Topoint, and have been asked if I can examine the contents. You can read on to hear about my efforts so far, but I have several questions: If the surveillance device came from a vendor, what kind of file system might they use, and if - as I suspect - it is encrypted, do I have any options other than writing zeros over the drive and putting it to less controversial use?" "Not knowing what to do with the audio chip, I focused on the notebook hard drive. I got an adapter, connected it as master on my desktop and booted up. After checking the BIOS to see if the drive was recognised (it was), I was presented with a full-screen simple line diagram showing the floppy drive slot, a floppy with an arrow in front of it and across the bottom, the F keys with the F1 key depressed. Hitting F1 with or without entering a disk resulted in 'Non-system disk error...' So much for the direct approach.

Next I set the drive as slave and booted Linux (Mandrake and then a few Live CDs), but the drive contents weren't recognised due to the lack of a partition table. So, I kept it as slave and ran a few forensic and data recovery tools in Windows: DFSee and tools from Mare Software and Runtime Software. I couldn't recognize the file system or recover anything from the drive with these, so I figure it isn't formatted with any of the standard FAT, FAT32, HPFS, NTFS, JFS, EXT2/3 or REISER file systems. I've kind of reached the limit of my abilities here, but my curiosity has been stoked.

Does anyone have any suggestions or comments - useful or otherwise? To anticipate a few in advance: Yes, listening devices might well run Linux. We're not in the US and are more interested in human rights than terrorism. My friend obviously knows most of what has been recorded, but wants to figure out how long the bug was in place."

Comments

First, make a copy!

[PaulBu]

dd if=/dev/hdb of=/home/me/image

(assuming you have free 20G on your HDD)

Then try file /home/me/image -- if disk was
used just to dump data, you might as well see that it is a WAV file.

Then try strings /home/me/image|less and see if you notice anything special. If all your strings will be 4-letter random words, most probably it is encrypted and you are out of luck. Or maybe not, if they used something like XOR -- try building a hystogram of byte values distribution. If it is flat -- well, then you are screwed with a well-encrypted disk, and your best bet is to secretly ship the disk to a TLA of your country's adversary. ;-)

Paul B.

Re:First, make a copy!

[BJH]

If you're living in the US, you might not be aware of it, but most major US retail sites make it quite difficult for people overseas to utilise their services.
For example, they refuse to allow the use of credit cards with a billing address outside the US, require a copy of the front and back of the card to be sent to them by snailmail, charge absolutely exorbitant shipping rates (I'm talking $US40 for non-express shipping on a $US100 item that's no bigger than a hardback book), and that sort of thing.

Re:First, make a copy!

[Dr. Evil]

Don't forget customs brokerage and the occasional secondary shipping charge for customs to intercept, find nothing and send it on its way.

Re:Hmm

[ar32h]

Toppoint may build custom chips / build clone chips.
Any/all numbers on the chip would probably be more useful than the manufacturer's name.

Also, and perhaps a red herring, could the device in question be the product found here?
It is a GPS tracker with audio recording capability. It also happens to take 20G drives and uses a SOIC for control.
It may be a jump, but Toppoint could have been the board builder.

Exact same thing happened to me.

[Perdo]

And unless you want to be charged as an accessory after the fact or evidence tampering, you will get far, far away from that woman, even if the sex is good.

No, really.