Forensic image of the microSD card of a HackRF One with PortaPack Mayhem firmware (E01)

Forensic image (EnCase 6 / E01) of the FAT32 partition of the microSD card of the author's own HackRF One with a PortaPack running Mayhem firmware v2.0.1. It is the image examined in the paper Forensic Analysis of the HackRF One with PortaPack Mayhem Firmware by Düzgün Küçük (arXiv:2610.20647, doi:10.48550/arXiv.2610.20647).

The raw (dd) logical-volume image was acquired with FTK Imager; acquisition completed on 2024-12-20 08:42:28 UTC. It was stored in segmented EWF format on 2026-10-08 without any change to its content. The image is one EnCase evidence file split into four segments (E01–E04); forensic tools open the .E01 file and read the other segments automatically, so all four must be in the same folder. Media size: 3,908,042,752 bytes (7,632,896 sectors of 512 bytes).

Hashes of the imaged data (stored inside the E01 and identical to the values reported in the paper): MD5 051d13575d2029c5a62786b65fa4df38; SHA-1 c64750034da79d21d354754a5a4f0b005f974824; SHA-256 99f6f02ef2e24df51566ad50280b421e6bae07d51a7e342d2e63d857ce2e948e. SHA-256 values of the four segment files are listed in SHA256SUMS.

Verification: sha256sum -c SHA256SUMS and ewfverify -d sha256 hackrf_portapack_sd.E01 (with all segments present). The image can be opened with The Sleuth Kit, Autopsy, FTK Imager, X-Ways or ewfmount.

The image is published unredacted by its owner. It contains the owner's own usage data (settings, radio captures of the owner's own remote control, screenshots) and one Bluetooth Low Energy advertisement received from a nearby device during a capture.