Forensic Analysis of Plug Computers

  • Scott Conrad
  • Greg Dorn
  • Philip Craiger
Part of the IFIP Advances in Information and Communication Technology book series (IFIPAICT, volume 361)


A plug computer is essentially a cross between an embedded computer and a traditional computer, and with many of the same capabilities. However, the architecture of a plug computer makes it difficult to apply commonly used digital forensic methods. This paper describes methods for extracting and analyzing digital evidence from plug computers. Two popular plug computer models are examined, the SheevaPlug and the Pogoplug.


Plug computers forensic analysis SheevaPlug Pogoplug 


  1. 1.
    Amontec, Open On-Chip Debugger (OpenOCD), Vuippens, Swit- zerland ( Scholar
  2. 2.
    M. Breeuwsma, M. de Jongh, C. Klaver, R. van der Knijff and M. Roeloffs, Forensic data recovery from flash memory, Small Scale Digital Device Forensics Journal, vol. 1(1), 2007.Google Scholar
  3. 3.
    C. Brune, Lost art of computer programming, Das U-Boot: The universal boot loader (, 2004.Google Scholar
  4. 4.
    Cloud Engines, Pogoplug, San Francisco, California ( Scholar
  5. 5.
    DENX Software Engineering, Memory commands, DENX U-Boot and Linux Guide, Groebenzell, Germany ( Scholar
  6. 6.
    DENX Software Engineering, U-Boot, Groebenzell, Germany ( Scholar
  7. 7.
    Hwaci Applied Software Research, SQLite ( Scholar
  8. 8.
    IEEE Standards Association, 1149.1-1990 – IEEE Standard Test Access Port and Boundary-Scan Architecture, Piscataway, New Jersey, 1990.Google Scholar
  9. 9.
    Iomega, Iomega iConnect wireless data station, San Diego, California ( Scholar
  10. 10.
    Marvell Semiconductor, SheevaPlug Development Kit Reference Design, Santa Clara, California ( /us/resources/downloads?func=startdown&id=90), 2010.Google Scholar
  11. 11., Plug Wiki ( Scholar
  12. 12., Forums ( Scholar
  13. 13., How to find mkfs, jffs and other tools on Pogoplug ( Scholar
  14. 14.
    D. Rath, Open On-Chip Debugger ( Scholar
  15. 15.
    D. Rath, OpenOCD User’s Guide ( Scholar
  16. 16.
    J. Regan, The Forensic Potential of Flash Memory, Master’s Thesis, Department of Computer Science, Naval Postgraduate School, Monterrey, California, 2009.Google Scholar
  17. 17.
    M. Rosenbum and J. Ousterhout, The design and implementation of a log-structured file system, Proceedings of the Thirteenth ACM Symposium on Operating System Principles, pp. 1–15, 1991.CrossRefGoogle Scholar
  18. 18.
    Seagate Technology, FreeAgent DockStar, Scotts Valley, California ( agent_dockstar).Google Scholar
  19. 19.
    Sun Microelectronics, Introduction to JTAG Boundary Scan, White Paper, Sun Microsystems, Santa Clara, California (, 1997.Google Scholar
  20. 20.
    UBIfs Wiki ( Scholar
  21. 21.
    D. Woodhouse, JFFS: The Journaling Flash File System ( Scholar
  22. 22.
    D. Woodhouse, UBI – Unsorted Block Images ( Scholar

Copyright information

© IFIP International Federation for Information Processing 2011

Authors and Affiliations

  • Scott Conrad
    • 1
  • Greg Dorn
    • 1
  • Philip Craiger
    • 2
    • 1
  1. 1.National Center for Forensic ScienceUniversity of Central FloridaOrlandoUSA
  2. 2.Daytona State CollegeDaytona BeachUSA

Personalised recommendations