An open-source USB drive presents an 8 GB decoy partition while keeping a separate encrypted partition hidden until a specific unlock file is created.
The Phantom Drive, created by Rootkit Labs, is an open-source USB storage device designed to hide an encrypted partition behind an 8 GB decoy drive. When connected to a computer, it appears as a regular USB drive. The hidden partition is unlocked only when a specific text file containing the required password format is created.
The gadget utilises the CH569 microcontroller that incorporates the USB 3, SD/eMMC, and AES hardware modules. Instead of using NAND memory chips, the custom printed circuit board employs microSD cards to store the 8GB decoy partition along with the hidden partition. The microSD card is provided by the user rather than being incorporated into the gadget itself.
The customised firmware captures raw data packets transmitted through the USB bus and searches for the required unlock-file string. Once the correct password is received, it copies the password into SRAM, while the captured data packet is erased with zeros before being stored on the SD card. The encryption key is then generated using the password and hardware ID of the microcontroller using PBKDF2-HMAC-SHA-256.
The generated key unlocks and locks the partition, which is coupled to the hardware identifier of the microcontroller used in the process. Therefore, transferring the SD Card to a different Phantom Drive will not unlock the partition. Moreover, access to the hidden partition cannot be gained directly by inserting the SD card into the card slot.
The firmware can be compiled to imitate particular vendor IDs, making the hardware appear as USB storage from a different manufacturer. The development environment includes recovery software for Linux platforms; however, storage capacity is constrained by the USB 2 interface. Claimed speeds reach 20 MB/s read and 9 MB/s write when the encryption mode is set to AES-CTR, and 10 MB/s read and 6 MB/s write with AES-XTS modes.
Phantom Drive is available as a prebuilt device, but it can also be built independently because the project is open-source. The project provides PCB layout files, schematics, a bill of materials, custom firmware, and related tools.
