HDD forensics
Modern HDDs contain a portion of their firmware stored on the platters. This is loaded into the HDDs controller processor/memory at startup to complete the firmware image. If any of this 'soft' firmware has been changed by the owner, in order to defeat the disk being simply bit-copied, then there is pretty much zero chance of reading the data without resorting to 'clean room' HDD recovery-style operations (removing individual platters to a donor HDD, for example). This operation alone could call in to question the forensic veracity of the resultant data extracted before decryption comes in to the picture. I would expect that the NCA have access to expertise to handle all this, even if not quite routine. I wonder why they have failed?
Biting the hand that feeds IT
