Phantomdrive hidden USB is Rootkit Labs’ attempt to make encrypted storage present itself to a computer as an ordinary 8GB flash drive. The open-source project, developed by Ryan Walker, holds back a separate encrypted area until its firmware sees a specific password command written to the visible volume, according to Tom’s Hardware and Hackster.
The design is aimed at concealment as well as data protection. Rootkit Labs has said it built Phantomdrive for situations in which someone might be pressured to show a storage device’s contents. That is the creator’s stated use case, not evidence that the device can defeat forensic examination, physical inspection or legal compulsion.
How does Phantomdrive unlock its hidden storage?
On connection, the device exposes only its 8GB decoy volume. To change that state, a user creates a file named unlock.txt containing a line in the form password:<user password>. Hackster reports that Phantomdrive then disconnects the visible volume and mounts the hidden one in its place.
The interesting bit is where the password is supposed to go: nowhere permanent. Tom’s Hardware and Hackster report that firmware watches raw USB write traffic for the password: pattern, copies the password into RAM, then clears the outbound write data before it reaches the microSD card. The operating system may believe it created the text file, while the device is designed to prevent the password from being saved to the decoy storage. Those are reported design claims, not independently verified findings.
The hidden area uses AES-256, a form of encryption that turns readable data into ciphertext controlled by a key. According to Tom’s Hardware, Phantomdrive derives that key from the user password and the WCH CH569 microcontroller’s unique hardware ID, using PBKDF2-HMAC-SHA-256 for 100,000 iterations. The report says users can select 600,000 iterations instead.
That hardware ID acts as a device-specific salt. Tom’s Hardware and Hackster report that putting the same microSD card in another Phantomdrive should not reproduce the key, even with the same password. The reports also say that reading the card through a conventional microSD slot does not expose the hidden partition.
What hardware and trade-offs does Phantomdrive have?
Phantomdrive uses a CH569 controller and a removable, user-supplied microSD card rather than onboard NAND or eMMC storage. Tom’s Hardware reports that Walker chose the card-based approach because of component pricing. The project’s published materials include PCB layout files, schematics, a bill of materials, firmware and related tools, according to the publication.
It is a USB 2 device, and speed is the obvious compromise. Tom’s Hardware reports reads of 20 MB/s and writes of 9 MB/s in AES-CTR mode, falling to 10 MB/s reads and 6 MB/s writes in AES-XTS mode. Physical access could also let someone remove the microSD card, though encryption is intended to protect its contents.
Pricing is less clear. Tom’s Hardware reported a $50 prebuilt unit, while Hackster listed $58; both say buyers need to supply the microSD card. The available reports provide no independent security audit, penetration test or reproducible assessment of Phantomdrive’s resistance to forensic tools, which is a fairly significant blank space for a product selling concealment as a feature.
This story draws on original reporting from Tom's Hardware.
