Option 1: Acquire an image of a Chromebook hard disk

Warning/Disclaimer: Switching a Chromebook to developer mode will wipe the storage disk on the device, which defeats the entire purpose of imaging your Chromebook. Please proceed with caution and understand the risks before attempting to perform this action.


Requirements:

  • OSFClone
  • USB flash drive (for booting Linux)
  • External hard disk (for storing the Chromebook image)

To acquire an image of a Chromebook hard disk, you will need to perform the following steps

  1. Switch to Developer Mode (WARNING: MAY WIPE HARD DISK)
  2. Create a bootable Linux USB flash drive
  3. Image the hard disk (using the bootable USB drive)

Because of the complexity of the Chromebook boot process, one or more of these steps may be tricky depending on which particular Chromebook you are running on. Once you are able to get a Linux distribution running on your Chromebook, you can simply run the 'dd' command to perform the imaging of the hard disk.

Entering Developer Mode

Before we can boot from a USB drive, Developer Mode must be enabled on the Chromebook. Keep in mind that if you switch the device to Developer Mode at this time, the system’s data stored on the disk will be wiped and not recoverable. If you wish to proceed, please follow the recommended procedure for entering Developer Mode for your device.

For an updated list of Chromebook devices, see here

Creating a bootable USB drive

Next, we need to create a bootable USB drive. The procedure will depend on which Chromebook you are using. Please note that not all procedures have been tested on the corresponding Chromebook devices.

If you have an Acer C720 Chromebook, HP Chromebook 14, Chromebook Pixel, or any other Chromebook with SeaBIOS legacy boot, you should be able to install OSFClone or your favourite Linux distribution on a USB drive as you would for a PC. When you start up your Chromebook, you need to press Ctrl-L at the white boot splash screen to start SeaBIOS. Press Esc to get a boot menu and select the number corresponding to your USB drive.

For Samsung Series 3 Chromebox, Samsung Series 5 550 Chromebook and Acer C7 Chromebook, please follow the instructions here to create a bootable USB disk

Once you have created the bootable USB image, ensure that you are able to boot it on your Chromebook.

Imaging the hard disk

Before you boot from the USB drive, plug in an external hard disk that has enough space to store the Chromebook hard disk image. Proceed to boot from the USB flash drive (by pressing Ctrl-U at the white boot splash screen).

If you are booting OSFClone, follow the prompts to acquire your image.

If you are booting from another Linux distribution, you need to run the following commands

  1. Mount the external drive
            mkdir /mnt/sdb1
            mount /dev/sdb1 /mnt/sdb1
    
    Replace '/dev/sdb1' with the device name of your external drive's partition

  2. Use 'dd' to create a bit-by-bit image of the Chromebook hard disk
            dd if=/dev/sda of=/mnt/sdb1/chromebookhd.img conv=sync,noerror bs=64K
    
    If your external disk is low in disk space, you can try to create a compressed image using the following command:
            dd if=/dev/sda conv=sync,noerror bs=64K | gzip -c  > /mnt/sdb1/chromebookhd.img.gz
    
    Replace '/dev/sda' with the device name of the Chromebook hard disk, '/mnt/sdb1/chromebookhd.img' with the output filepath of the resulting image file

Option 2: Extracting a decrypted logical backup of the encrypted data

Daniel Dickerman has detailed a process to extract a decrypted backup of all encrypted data.
Full instructions at https://dfir.pubpub.org/pub/inkjsqrh/release/1

This method does NOT require the device to be in Developer Mode

This will not produce a full disk image but will allow you to extract most user and system data of evidentiary value.
This will allow you to extract more data than simply logging in to the device and copying user files, particularly;
- /mnt/stateful_partition/encrypted
- /home/chronos
- /var


Requirements:


Process Overview

  1. Create a recovery usb for the specific chromebook model
  2. Use the "create_encrypted_partition_recovery_usb.sh" script to modify the recovery usb
  3. Boot into recovery mode on the chromebook and insert the modifed recovery USB
  4. Enter email and password of account to get data from
  5. Wait to finish, may have to reboot once on some devices
  6. USB will have a file called extracted.tgz with the data

You can find the required scripts at https://dfir.pubpub.org/pub/inkjsqrh/release/1