PS2 Hard disk encryption

[vmanoussos]

Hi everyone

I am a computer forensics consultant and I deal with retrieving data from hard drives.

I have a case of a PS2 and I need to find out when was the last time it was used.

So I thought I would go straight to the source and ask people who probably already know about it:

1. Is the PS2 drive encrypted the same as PS3?

2. Do you know how the login / user history is saved ?

3. Do you know if the PS2 keeps browsing history the way computers do?


Guys I appreciate all the help. Really.


Regards

Vassilis

[Yuki]

Hi Vassilis,

I'll try my best to answer your questions :3

1. Is the PS2 drive encrypted the same as PS3?

No - the PS3 has forced whole drive encryption whereas the PS2 supports optional encryption on a per-partition basis. This is only used in a small number of cases, for example the Install Data of Final Fantasy XI. I'm not sure about the actual algorithm but judging by the fact that l_oliveira has managed to extract files from a raw dump I'd say it's weaker than the PS3.

2. Do you know how the login / user history is saved ?

The PS2 runs a single user operating system so there are no logins or users. I do believe that each file is time-stamped though.

3. Do you know if the PS2 keeps browsing history the way computers do?

As far as I know there's no chronological list as there is with the PS3 (history.xml) however you can at least have an idea which applications have been used by looking at the "Save Games".

As for how to proceed, I would advise connecting the HDD to a PS2 with a write blocker and using uLE to read the filesystem as it'll be able to give you as much detail as possible with regard to time-stamps etc. You may have to modify the case as I doubt there's a write blocker small enough to fit in between the drive and adapter while it's connected in the usual way

Regards,

-Yuki

[Berion]

@vmanoussos
Read about APA/PFS fs.