Virus attack behavior processing method and device based on hard disk storage chip

Abstract

The present invention discloses a virus attack behavior processing method and device based on a hard disk storage chip, the method comprising: according to the guidance of ransomware protection software, set the protection folder path and the protection file type, according to the file system directory table in the hard disk, locate the LBA address of the file header and key sector of each type of file format, form a sector bitmap and write it into the storage chip for the main control chip to call, and synchronize with the folder system in real time; according to the formed sector bitmap, obtain the LBA sector address of the file header sector and the PBA sector address used when the hard disk is stored; monitor the process of the ransomware protection software or the queue data packet in the hard disk storage chip, and judge whether there is a ransomware attack behavior; if there is a ransomware attack behavior, the main control chip interrupts the connection with the hard disk. The present invention can effectively monitor and block the virus attack behavior.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and device for processing virus attack behaviors based on a hard disk storage chip. Background Art

[0002] The monitoring and protection of ransomware attacks has always been focused on network security and operating systems, mainly through installing antivirus software, configuring network boundary security devices, and plugging loopholes. However, this series of monitoring and protection methods have a certain lag. For example, if antivirus software wants to identify ransomware, it must be based on an existing virus feature library. It takes time for a new ransomware to spread, discover, extract virus features, and update the antivirus software feature library. It takes days to months to plug security loopholes. During these blank periods, it is impossible to effectively monitor and protect against new or variant ransomware. Summary of the invention

[0003] In view of this, the present invention provides a method and device for processing virus attack behavior based on a hard disk storage chip.

[0004] The present invention discloses a virus attack behavior processing method based on a hard disk storage chip, which comprises:

[0005] Step 1: Set the protected folder path and protected file type according to the antivirus software. According to the file system directory table in the hard disk, locate the LBA address of the file header and key sector of each type of file format, form a sector bitmap and write it to the storage chip for the main control chip to call, and synchronize it with the folder system in real time; the key sectors include MBR sectors and DBR sectors;

[0006] Step 2: According to the formed sector bitmap, obtain the LBA sector address of the file header sector and the PBA sector address used when storing on the hard disk;

[0007] Step 3: Monitor the process of the virus protection software or the queue data packets in the hard disk storage chip to determine whether there is a virus attack; if there is a virus attack, the main control chip interrupts the connection with the hard disk.

[0008] Furthermore, before step 1, the method further includes:

[0009] Establish a connection relationship between the PCI-E hardware card, host and hard disk in the computer; wherein the PCI-E hardware card includes a main control chip and a storage chip; the host of the computer is loaded with virus monitoring and protection software; the host is connected to the main control chip and the storage chip respectively; the storage chip is connected to the main control chip and the hard disk respectively; and a hard disk storage chip is set in the hard disk.

[0010] Furthermore, the step 2 comprises:

[0011] After the sector bitmap is established, the main control chip sends a key to the hard disk, reads the compiler module in the hard disk, and writes it to the storage chip for the main control chip to call, so as to translate the PBA address of the file header and obtain the LBA sector address corresponding to the file header.

[0012] Furthermore, the step 3 comprises:

[0013] The main control chip monitors the API handshake with the virus protection software in real time. If a hacker or virus terminates the software process, the main control chip immediately detects the API handshake interruption and sends a sleep command to the hard disk, putting the hard disk into sleep mode, stopping the motor, and returning the head to the start-stop area; the main control chip closes its communication channel with the hard disk.

[0014] Furthermore, the step 3 comprises:

[0015] The write PBA address of the queue data packets in the hard disk storage chip is monitored. The main control chip calls the sector bitmap to obtain the file header sector of the type file format stored at the PBA address. The main control chip calls the file format standard template library built into the storage chip for comparison. If the data written to the PBA address is inconsistent with the built-in file format standard, it is determined that there is an attack behavior; when it is determined that there is an attack behavior, the main control chip sends a sleep command to the hard disk, causing the hard disk to enter a sleep state, the motor to stop, and the head to return to the start-stop area; the main control chip closes its communication channel with the hard disk.

[0016] Furthermore, after step 3, the method further includes:

[0017] Disassemble the hard disk and use it to mirror the entire hard disk. Then connect the mirrored disk to a safe and virus-free isolated network computer to check and remove viruses and extract data, or connect it to a forensic hardware device to selectively extract data.

[0018] The present invention also discloses a virus attack behavior processing device based on a hard disk storage chip, which includes: a hard disk, a PCI-E hardware card and a host; the host is connected to the hard disk via the PCI-E hardware card; the PCI-E hardware card includes a main control chip and a storage chip; the hard disk is provided with a hard disk storage chip;

[0019] The host is used to store virus monitoring and protection software, and is connected to the hard disk through the main control chip and the storage chip respectively;

[0020] The virus protection software in the host is used to locate the sector where each file header and the sector where the file system key table are located according to the file system directory table in the hard disk, form a sector bitmap, and write it into the storage chip for the main control chip to call;

[0021] The main control chip is used to determine whether there is a virus attack based on the process of the virus monitoring and protection software or the queue data packets in the hard disk storage chip; if there is a virus attack, the main control chip interrupts the connection with the hard disk.

[0022] Furthermore, the main control chip is used to monitor the API handshake with the virus protection software in real time. If a hacker or virus terminates the software process, the main control chip immediately detects the API handshake interruption and sends a sleep command to the hard disk, putting the hard disk into sleep mode, stopping the motor, and returning the head to the start-stop area; the main control chip closes its communication channel with the hard disk.

[0023] Furthermore, the main control chip and the queue to be written of the monitoring hard disk storage chip read the compiler module of the hard disk; at the same time, the storage chip is used to store the compiler module of the hard disk and the sector bitmap generated by the virus monitoring and protection software;

[0024] The main control chip is used to translate the PBA sector address of the data packet to be written into the queue into the LBA sector address according to the compiler module, and compare it with the file format corresponding to the LBA sector address to determine whether there is an attack; if there is inconsistency, it is determined that there is an attack, and the main control chip is used to send a sleep command to the hard disk to put the hard disk into sleep mode, stop the motor, and return the head to the start-stop area; the main control chip closes its communication channel with the hard disk.

[0025] Furthermore, after the main control chip closes the channel for communicating with the hard disk, the hard disk is disassembled to a hard disk copier to mirror the entire hard disk; the mirror disk is connected to a safe and non-toxic isolated network computer to check and eliminate viruses and extract data, or it is connected to a forensic hardware device to selectively extract data.

[0026] Due to the adoption of the above technical solution, the present invention has the following advantages: it can effectively monitor and prevent new ransomware viruses or variant ransomware viruses. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0028] Figure 1 A schematic diagram of a virus attack behavior processing device based on a hard disk storage chip according to an embodiment of the present invention;

[0029] Figure 2 A schematic diagram of a sector bitmap according to an embodiment of the present invention;

[0030] Figure 3This is a flow chart of a method for monitoring attack behavior by a main control chip according to an embodiment of the present invention;

[0031] Figure 4 A flowchart of a method for processing virus attack behavior based on a hard disk storage chip according to an embodiment of the present invention;

[0032] Figure 5 The present invention is a flowchart of another method for processing virus attack behaviors based on a hard disk storage chip according to an embodiment of the present invention. DETAILED DESCRIPTION

[0033] The present invention is further described in conjunction with the accompanying drawings and embodiments, and the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field should fall within the scope of protection of the embodiments of the present invention.

[0034] See also Figure 4 The present invention provides an embodiment of a method for processing virus attack behavior based on a hard disk storage chip, which comprises the following steps:

[0035] S1: Install software and hardware: Install ransomware monitoring and protection software and PCI-E hardware card on the computer. Connect the SATA1 port of the PCI-E hardware card to the computer host, and connect the SATA2 port of the PCI-E hardware card to the hard disk. Set the protection folder path and file type according to the software guidance; the ransomware monitoring and protection software is loaded in the host.

[0036] S2: The software reads the hard disk file system to form a bitmap, writes it into the hardware card storage chip, and synchronizes it with the file system in real time: The software reads the hard disk file system according to the user settings, locates the logical block address (LBA) of key sectors such as file headers, MBR, DBR, etc. of various types of file formats, forms a sector bitmap, digitally writes it into the hardware card storage chip for the main control chip to call, and synchronizes it with the folder system in real time.

[0037] In an optional embodiment, starting from the working principle of hard disk writing data, taking Western Digital hard disk as an example, a PCI-E (high-speed serial computer expansion bus standard) interface hardware is developed to connect the host and the hard disk SATA (Serial Advanced Technology Attachment-Serial ATA) port, wherein the SATA1 port of PCI-E is connected to the host, and the SATA2 port of PCI-E is connected to the hard disk. The hard disk storage chip waiting to be written queue is monitored through the ATA (Advanced Technology Attachment-interface protocol between the hard disk drive and the host) protocol, and the hard disk compiler module No. 31 is read. At the same time, the hard disk onboard storage chip is used to store the hard disk compiler module No. 31 and the sector bitmap generated by the software.

[0038] Some early ransomware viruses would call the hard disk firmware encryption module to encrypt the entire hard disk. Since it can be easily unlocked through hard disk firmware debugging, existing ransomware encryption attacks use encryption algorithms to completely encrypt files smaller than the threshold size set by the ransomware virus to ensure encryption effect and efficiency, and encrypt a certain number of sectors from the file header for files larger than the threshold size set by the ransomware virus.

[0039] Therefore, the ransomware protection software of this embodiment will locate the sector where each file header is located and the sector where the file system key table is located according to the file system directory table in the hard disk to form a sector bitmap, such as Figure 2 As shown, after digitization, it is written into the hardware card storage chip for the main control chip to call.

[0040] S3: The main control chip sends the technical key to open some functions in the firmware area, reads the No. 31 compiler module and writes it into the storage chip: After the sector bitmap is established, the main control chip sends the technical key to the hard disk through the ATA protocol, opens some functions in the firmware area, reads the No. 31 compiler module and writes it into the hardware card storage chip for the main control chip to call the physical block address (PBA) where the translation file header is located.

[0041] S4: The software and hardware start to work normally and monitor the hard disk storage chip;

[0042] S5: Hacker or virus attack or illegal shutdown of control software process: When hacker network attack or ransomware attack reaches the point of data erasure or allowing multi-threaded file encryption, most non-operating system key processes must be closed. On the one hand, it is to ensure that files or sectors are not blocked from being written because of some program processes calling files, and on the other hand, it is to occupy computer resources as much as possible to ensure attack efficiency. Therefore, the software process of the present invention can be used as a basis for judging whether the main control chip monitors whether there is an attack behavior.

[0043] S6: The main control chip finds that the API handshake is interrupted and immediately sends a SLEEP command to the hard disk: The main control chip monitors the API (application programming interface) handshake with the software in real time. Once the hacker or ransomware terminates the software process, the main control chip will immediately detect the API handshake interruption. At this time, the SLEEP command is immediately sent to the hard disk through the ATA protocol to put the hard disk into sleep mode, stop the motor, and return the head to the start-stop zone. This command is one of the four working states of the hard disk that can be called through the ATA protocol as specified in the ATA protocol specification. It is a specification followed by all brands of hard disk manufacturers. Using the SLEEP command will not cause damage to the hard disk and data.

[0044] S7: The main control chip shuts down the SATA2 port channel, physically preventing data encryption or erasure caused by ransomware or hacker intrusion.

[0045] S8: Disassemble the hard disk and put it into a hard disk duplicator to mirror the entire hard disk. At this time, since the hard disk is not connected to the operating system, even if there is a virus in the hard disk, it cannot be activated.

[0046] S9: Connect the image disk to a safe and virus-free isolated network computer to check and remove viruses and then extract data, or connect it to a forensic hardware device to extract data.

[0047] See also Figure 5 The present invention provides another embodiment of a virus attack behavior processing method based on a hard disk storage chip, which comprises the following steps:

[0048] S11: Install software and hardware: Install ransomware monitoring and protection software and PCI-E hardware card on the host computer, connect SATA1 port to the host, and connect SATA2 port to the hard disk. Set the protection folder path and protection file type according to the software guidance.

[0049] S12: The software reads the hard disk file system to form a bitmap, writes it into the storage chip in the hardware card, and synchronizes it with the file system in real time: The software reads the hard disk file system according to the user settings, locates the LBA addresses of key sectors such as file headers, MBR, DBR, etc. of various types of file formats to form a sector bitmap, digitally writes it into the hardware card storage chip for the main control chip to call, and synchronizes it with the folder system in real time.

[0050] In one embodiment, some feasible implementations included in step S12 can be found in Figure 4 The description of the relevant steps in the embodiment will not be repeated here.

[0051] S13: The main control chip sends the technical key to open some functions in the firmware area, reads the No. 31 compiler module and writes it into the storage chip: After the sector bitmap is established, the main control chip sends the technical key to the hard disk through the ATA protocol, opens some functions in the firmware area, reads the No. 31 compiler module and writes it into the hardware card storage chip for the main control chip to call the PBA address where the translation file header is located.

[0052] S14: The software and hardware start to work normally and monitor the hard disk storage chip;

[0053] S15: The main control chip monitors that the file header code of the cache chip queue data packet is inconsistent with the software built-in file header template code: The main control chip monitors that the PBA address written by the cache chip queue data packet is a file header address in the sector bitmap, and then calls the software built-in file header template code for comparison according to the sector bitmap information. If the comparison result does not conform to the file format standard file header, it is determined that there is an attack behavior.

[0054] In an optional embodiment, based on the sector bitmap formed by the software, the main control chip calls the compiler module No. 31 to calculate, for example, the LBA (Logic Block Address) sector address where the DOC file header sector is located and the PBA (physical block addresses) sector address used when storing on the hard disk. This allows the ATA protocol specification to monitor the write queue of the hard disk storage chip. Since the ransomware will generate a large number of write data packets when performing multi-threaded encryption, these write data packets will be marked with the write PBA address by the computer hardware scheduling and then written into the queue in the hard disk storage chip. At this time, by comparing the write address with the sector bitmap, it is possible to detect whether there is a ransomware encryption attack or a hard disk erasure behavior similar to KILLDISK (data erasure tool), such as Figure 3 shown.

[0055] In an optional embodiment, the hard disk storage chip monitoring function is turned on, and the main control chip will monitor the write PBA address of the queue data packet in the cache chip. If it contains a protected sector address, the sector bitmap in the storage chip is called to read the file path and file name, and the built-in file format standard template library of the software is called based on this information to compare and determine whether there is an attack. For example, Figure 3 In the cache chip queue, data packet 1 will be written to the PBA address 0X1C2E3C2D. The compiler module No. 31 is called to translate the LBA address stored as 0X3F4E7A. The sector bitmap is called to obtain that the address stores the file header sector of the 1.DOC file. At this time, the main control chip calls the file format standard template library built into the storage chip for comparison. If the three bytes of data 0X00-0X02 written to the PBA address are not D0CF11, it is determined that there is an attack.

[0056] S16: The main control chip immediately sends a sleep command to the hard disk: After the main control chip determines that there is an attack, the main control chip immediately sends a SLEEP command to the hard disk through the ATA protocol, so that the hard disk enters a sleep state, the motor stops, and the head returns to the start-stop area, blocking the attack process.

[0057] S17: The main control chip shuts down the SATA2 port channel, physically preventing data encryption or erasure caused by ransomware or hacker intrusion.

[0058] S18: Disassemble the hard disk and put it into a hard disk copier to mirror the entire hard disk. At this time, since the hard disk is not connected to the operating system, even if the hard disk contains a virus, it cannot be activated.

[0059] S19: Connect the image disk to a safe and virus-free isolated network computer to check and remove viruses and then extract data, or connect it to a forensic hardware device to extract data.

[0060] The present invention reads the key sectors of the hard disk and the file system through software, locates the key sectors such as MBR (Master Boot Record), DBR (DOS BOOT RECORD), and the file header sector addresses of various types of file formats under various levels of directories, forms a sector bitmap and digitizes it and writes it into the hardware card storage chip. The hardware card main control chip calls the No. 31 compiler module stored in the storage chip to translate the PBA address corresponding to the file bitmap, monitors the hard disk storage chip to write the queue data packet information, and if an illegal write queue data packet is found, the main control chip immediately sends a SLEEP (sleep) instruction to the hard disk through the ATA protocol, so that the hard disk enters a dormant state, and then the main control chip physically closes the SATA2 port channel, forming a set of cache chip monitoring methods based on the working principle of the hard disk hardware, which can effectively detect the encryption behavior of ransomware viruses and the hard disk erasure behavior caused by network attacks or human malicious attacks, and provides a method for blocking the attack process.

[0061] See also Figure 1 The present invention also provides a virus attack behavior processing device based on a hard disk storage chip, which includes: a hard disk, a PCI-E hardware card and a host; the host is connected to the hard disk through the PCI-E hardware card; the PCI-E hardware card includes a main control chip and a storage chip; the hard disk is provided with a hard disk storage chip;

[0062] The host is used to store virus monitoring and protection software, and is connected to the hard disk through the main control chip and the storage chip respectively;

[0063] The virus protection software in the host is used to locate the sector where each file header and the sector where the file system key table are located according to the file system directory table in the hard disk, form a sector bitmap, and write it into the storage chip for the main control chip to call;

[0064] The main control chip is used to determine whether there is a ransomware attack based on the process of the ransomware monitoring protection software or the queue data packets in the hard disk storage chip; if there is a ransomware attack, the main control chip disconnects the hard disk.

[0065] The main control chip is used to monitor the API handshake with the ransomware protection software in real time. If the hacker or ransomware terminates the software process, the main control chip immediately detects the API handshake interruption and sends a sleep command to the hard disk, putting the hard disk into sleep mode, stopping the motor, and returning the head to the start-stop area; the main control chip closes its communication channel with the hard disk.

[0066] The main control chip and the monitoring hard disk storage chip have a queue to be written, and reads the compiler module of the hard disk; at the same time, the storage chip is used to store the compiler module of the hard disk and the sector bitmap generated by the ransomware monitoring and protection software;

[0067] The main control chip is used to translate the PBA sector address of the data packet to be written into the queue into the LBA sector address according to the compiler module, and compare it with the file format corresponding to the LBA sector address to determine whether there is an attack; if there is inconsistency, it is determined that there is an attack, and the main control chip is used to send a sleep command to the hard disk to put the hard disk into sleep mode, stop the motor, and return the head to the start-stop area; the main control chip closes its communication channel with the hard disk.

[0068] After the main control chip closes the channel of communication with the hard disk, the hard disk is disassembled to the hard disk copier to mirror the entire hard disk; the mirror disk is connected to a safe and non-toxic isolated network computer to check and eliminate viruses and then extract data, or it is connected to a forensic hardware device to selectively extract data.

[0069] The present invention provides a method and device for monitoring and blocking virus attack behaviors. Since the method and device are based on the underlying working principle of a hard disk and call the ATA protocol specification followed by various hard disk manufacturers, the present invention is not limited to operating systems and hard disk manufacturers. This article only uses the WINDOWS operating system and Western Digital hard disks as examples. EXT2, EXT3, EXT4, REFS, UFS, APFS, HFS, HFS+ adopted by other operating systems such as Linux, Ubuntu, Kylin, and Tongxin, as well as various domestic file systems and Seagate, Hitachi, and Toshiba brand hard disks are all applicable.

[0070] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for processing virus attack behavior based on a hard disk storage chip, characterized in that: include: Step 1: Set the protected folder path and protected file type according to the antivirus software. According to the file system directory table in the hard disk, locate the LBA address of the file header and key sector of each type of file format, form a sector bitmap and write it to the storage chip for the main control chip to call, and synchronize it with the folder system in real time; the key sectors include MBR sectors and DBR sectors; Step 2: According to the formed sector bitmap, obtain the LBA sector address of the file header sector and the PBA sector address used when storing on the hard disk; Step 3: Monitor the process of the virus protection software or the queue data packets in the hard disk storage chip to determine whether there is a virus attack behavior; if there is a virus attack behavior, the main control chip will interrupt the connection with the hard disk; The step 2 comprises: After the sector bitmap is established, the main control chip sends the key to the hard disk, reads the compiler module in the hard disk, and writes it to the storage chip for the main control chip to call, so as to translate the PBA address of the file header and obtain the LBA sector address corresponding to the file header; The step 3 comprises: The write PBA address of the queue data packets in the hard disk storage chip is monitored. The main control chip calls the sector bitmap to obtain the file header sector of the type file format stored at the PBA address. The main control chip calls the file format standard template library built into the storage chip for comparison. If the data written to the PBA address is inconsistent with the built-in file format standard, it is determined that there is an attack behavior; when it is determined that there is an attack behavior, the main control chip sends a sleep command to the hard disk, causing the hard disk to enter a sleep state, the motor to stop, and the head to return to the start-stop area; the main control chip closes its communication channel with the hard disk.

2. The method for processing virus attack behavior based on hard disk storage chip according to claim 1, characterized in that: Before step 1, the method further includes: Establish a connection relationship between the PCI-E hardware card, host and hard disk in the computer; wherein the PCI-E hardware card includes a main control chip and a storage chip; the host of the computer is loaded with virus monitoring and protection software; the host is connected to the main control chip and the storage chip respectively; the storage chip is connected to the main control chip and the hard disk respectively; and a hard disk storage chip is set in the hard disk.

3. The method for processing virus attack behavior based on hard disk storage chip according to claim 1, characterized in that: The step 3 comprises: The main control chip monitors the API handshake with the virus protection software in real time. If a hacker or virus terminates the software process, the main control chip immediately detects the API handshake interruption and sends a sleep command to the hard disk, putting the hard disk into sleep mode, stopping the motor, and returning the head to the start-stop area; the main control chip closes its communication channel with the hard disk.

4. The method for processing virus attack behavior based on hard disk storage chip according to claim 1, characterized in that: After step 3, the method further includes: Disassemble the hard disk to a hard disk duplicator to mirror the entire hard disk, connect the mirror disk to a safe and non-toxic isolated network computer to check and eliminate viruses and extract data, or connect it to a forensic hardware device to selectively extract data.

5. A virus attack behavior processing device based on a hard disk storage chip, characterized in that: include: Hard disk, PCI-E hardware card and host; the host is connected to the hard disk via the PCI-E hardware card; The PCI-E hardware card includes a main control chip and a storage chip; the hard disk is provided with a hard disk storage chip; The host is used to store virus monitoring and protection software, and is connected to the hard disk through the main control chip and the storage chip respectively; The virus protection software in the host is used to locate the sector where each file header and the sector where the file system key table are located according to the file system directory table in the hard disk, form a sector bitmap, and write it into the storage chip for the main control chip to call; The main control chip is used to determine whether there is a virus attack based on the process of the virus monitoring and protection software or the queue data packets in the hard disk storage chip; if there is a virus attack, the main control chip will interrupt the connection with the hard disk; The main control chip and the monitoring hard disk storage chip have a queue to be written, and reads the compiler module of the hard disk; at the same time, the storage chip is used to store the compiler module of the hard disk and the sector bitmap generated by the virus monitoring and protection software; The main control chip is used to translate the PBA sector address of the data packet to be written into the queue into the LBA sector address according to the compiler module, and compare it with the file format corresponding to the LBA sector address to determine whether there is an attack; if there is inconsistency, it is determined that there is an attack, and the main control chip is used to send a sleep command to the hard disk to put the hard disk into sleep mode, stop the motor, and return the head to the start-stop area; the main control chip closes its communication channel with the hard disk.

6. The virus attack behavior processing device based on hard disk storage chip according to claim 5 is characterized in that: The main control chip is used to monitor the API handshake with the virus protection software in real time. If a hacker or virus terminates the software process, the main control chip immediately detects the API handshake interruption and sends a sleep command to the hard disk, putting the hard disk into sleep mode, stopping the motor, and returning the head to the start-stop area; the main control chip closes its communication channel with the hard disk.

7. The virus attack behavior processing device based on a hard disk storage chip according to claim 5 or 6, characterized in that: After the main control chip closes the channel for communication with the hard disk, the hard disk is disassembled to a hard disk copier to mirror the entire hard disk; the mirror disk is connected to a safe and non-toxic isolated network computer to check and eliminate viruses and extract data, or it is connected to a forensic hardware device to selectively extract data.

Images