2025/05/09 by Tobias Latzo, Florian Hantke, Latzo, Tobias +5
Computer Science · #Cryptography and Security (cs.CR) #Digital and Cyber Forensics #FOS: Computer and information sciences
paper · pdf · doi:10.48550/arxiv.2505.05697
openalex publication_date 2025/05/09 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Today's computer systems come with a pre-installed tiny operating system, which is also known as UEFI. UEFI has slowly displaced the former legacy PC-BIOS while the main task has not changed: It is responsible for booting the actual operating system. However, features like the network stack make it also useful for other applications. This paper introduces UEberForensIcs, a UEFI application that makes it easy to acquire memory from the firmware, similar to the well-known cold boot attacks. There is even UEFI code called by the operating system during runtime, and we demonstrate how to utilize this for forensic purposes.