jim wrote:
I dont think the whole hdd is encrypted :
http%3A%2F%2Fwww.computerforensicexaminer.com%2Fcomputer-forensics-expert-florida-miami-palm-beach-lauderdale-dave-kleiman-forensic-training-files%2FForensic_Analysis_of_a_Sony_Play_Station_3_PS3_Gaming_Console.pdf
quote: Although the Game OS partition is encrypted, the PS3 does not encrypt the Other OS
partition (as described below)
But surely sector 0 is in the encrypted section at the beginning of the drive?
In any case page 15 of the document suggests that a cloned HDD will function just like the original, so the security information appears to be specific to the console hardware, not to the drive. This would tend to confirm that one could copy sector 0 from a functioning drive to the original HDD, although one should probably choose a drive of identical capacity (or cut a larger drive to the original size) when formatting it.
That said, the document also states that the OS updates various sectors throughout the drive at every power-on.
"We found were numerous differences occurred in block-sized chunks randomly throughout the hard drive. The differences, however, were much more numerous in the beginning of the hard drive and became much more sparse farther down the hard drive. This test suggests that the console writes some kind of time stamp and/or random data to the hard drive every time it is powered on."
Hopefully sector 0 is not touched.