Overview
Software-defined radios (SSDRs) serve as platforms for replay attacks, location spoofing, and jamming. The HackRF One, when paired with a PortaPack interface board running Mayhem firmware, can operate as a stand-alone device. This research addresses the forensic analysis of this specific device family, a topic not covered by prior peer-reviewed studies.
The work identifies the location and format of forensically relevant data on the microSD card of a device operating Mayhem v2.0.1. It also details when data are written and how they should be interpreted. The methodology was applied to an SD card image acquired from the author's own device after four months of operational use. All inferences presented are drawn exclusively from this image.
Research Context
The HackRF One with PortaPack Mayhem firmware represents an inexpensive and portable SDR platform. Despite its capabilities in facilitating activities like replay attacks, location spoofing, and jamming, a peer-reviewed study focused on its forensic analysis has been absent until this publication.
Approach
The research established the methodology for forensic analysis at the source-code level. This involved determining the precise locations on the microSD card where forensically relevant data are stored, understanding their specific format, documenting the timing of data writes, and developing rules for their interpretation. The Mayhem firmware version analyzed was v2.0.1.
The methodology was then applied to a practical case: an SD card image derived from a device used by the author for a period of four months. The analysis was strictly confined to the information present within this single SD card image.
The workflow encompassed several specific areas:
- Timestamp rules, with consideration for the state of the real-time clock (RTC) battery.
- Traces left by on-device trimming operations.
- Traces left by text editing activities conducted on the device.
- Cluster-level recovery techniques for deleted in-phase/quadrature (IQ) captures.
- Decoding recorded signals, with cross-verification using an independent decoder.
Findings
Through the application of the developed methodology to the example SD card image, specific forensic artifacts and insights were obtained:
- The final portion of a deleted IQ capture was successfully recovered.
- A segment of a capture that had been trimmed away was also recovered.
- Six distinct captures were attributed to a single rolling-code on-off keying (OOK) transmitter. This transmitter shared a common 32-bit identifier across these six captures.
The study provides practitioners with a catalog of artifacts, rules for their interpretation, and recommendations for acquisition procedures.
Why This Matters
This study establishes a foundational approach for the forensic examination of HackRF One devices equipped with PortaPack running Mayhem firmware. By detailing where relevant data resides, its format, and how it is written and interpreted, it addresses a gap in peer-reviewed literature concerning this specific device family. The provision of an artifact catalogue, interpretation rules, and acquisition recommendations directly supports forensic practitioners in investigations involving these SDRs.