Anti-Forensics: Building a Phantomdrive

What it is

Phantomdrive is an open source USB drive (hardware, firmware and mechanical design) built on the WCH CH569 chip, which has USB3, SD/eMMC support and a hardware AES block. It presents an 8GB disk and keeps the rest of the storage hidden behind AES-256. The developer used an SD card because eMMC was too expensive, and plans an eMMC version when prices drop. The enclosure is sealed with epoxy, so opening it destroys it. Anyone who gets inside will find the SD card, but its contents are encrypted.

How it works

The firmware does not parse file systems. It handles raw WRITE10/READ10 commands and scans every write buffer for the string password:. On a match it copies the text up to a newline, carriage return or NUL into RAM, then zeroes the buffer so the password never reaches disk. The drive then disconnects and remounts with the hidden partition. The firmware builds on the hydrausb3 libraries wch-ch56x-lib (BSP) and wch-ch56x-isp (ISP).

Key derivation uses a per-device salt and 100,000 rounds of SHA-256. Because of the salt, an attacker must compute keys per device, and an SD card cannot be moved to another device. The KDF adds about 3 seconds to unlock, which the page says is already the chip's limit. Argon2 needs too much memory for this chip.

Measured speeds on this hardware:

The page describes ECB as leaking patterns and CTR as risky under nonce reuse. It calls XTS the disk encryption standard and the more secure choice. It does not say which mode ships by default. The developer checked encryption with functional tests and against OpenSSL's AES. Of the GitHub issues raised, one real one concerned AES-XTS; the page defers the detail to its AES section and gives none.

What to do

Record the device salt now, since it is needed to recover data if the device fails:

udevadm info --query=property --name=/dev/sdc | grep ID_SERIAL_SHORT
ID_SERIAL_SHORT=Phantomdrive:34FC1FA7145467F7

Here the salt is 34FC1FA7145467F7. Adjust /dev/sdc to the actual device node. For more stealth, change the Phantomdrive name and the USB PID/VID in firmware.

Caveats

• Any data on the visible partition containing password: can trigger a false match. The fix is to change the trigger string in firmware.
• The KDF is weaker than memory-hard options. The page suggests raising the round count, adding a software encryption layer, or using a different device.
• The page presents no independent audit. The developer's own verification is the only testing it reports.
• It makes no legal claims beyond saying a hidden VeraCrypt volume does not address being accused for merely having encryption.