Rootkit Labs Releases Phantom Drive to Hide Encrypted Data Behind Decoy USB
The open-source hardware project uses custom firmware to provide plausible deniability for users in high-risk environments.
Rootkit Labs has released Phantom Drive, an open-source stealth USB device designed to hide an AES-256 encrypted partition behind a decoy 8GB drive. The project aims to protect sensitive data from forced disclosure by appearing as a generic, low-capacity storage stick.
Developed by Ryan Walker, the device is powered by the CH569 microcontroller, utilizing its USB, SD/eMMC, and AES hardware blocks. It uses a user-provided microSD card to house both the visible 8GB decoy and the hidden encrypted volume. To unlock the secret partition, a user must create a specific text file containing a password. The custom firmware intercepts this password, copying it to SRAM and overwriting the data with zeroes before it ever reaches the physical SD card, ensuring the password is never stored on the disk.
The Logic of Plausible Deniability
Standard encrypted drives often signal their purpose to observers by announcing themselves as encrypted volumes or displaying scrambled data upon connection. This visibility can be a liability for users facing authoritarian governments or corrupt police. By presenting a functional but unremarkable 8GB decoy, the Phantom Drive provides plausible deniability, allowing the user to claim the device is merely a basic USB stick.
To further evade detection, the firmware can be recompiled to spoof specific vendor IDs, such as those of a Kingston Datatraveler, making the device appear as a common commercial product to scanning software.
Hardware-Level Security and Trade-offs
Security is tied directly to the hardware. The encryption key is generated using PBKDF2-HMAC-SHA-256 with either 100,000 or 600,000 iterations. This process is salted with the microcontroller's unique hardware ID, which means the microSD card cannot be unlocked if moved to another device.
This security comes with a performance cost. The device operates at USB 2.0 speeds. In AES-CTR mode, it achieves 20 MB/s read and 9 MB/s write speeds; in the more secure AES-XTS mode, performance drops to 10 MB/s read and 6 MB/s write.
Implications for High-Risk Users
For individuals in environments where basic encryption rights are not respected, the ability to hide the existence of data is as critical as the encryption itself. Ryan Walker stated the project is intended to "slip past authoritarian government representatives, corrupt police, and anyone else that doesn't respect basis encryption rights."
What to Watch
As an open-source project, the Phantom Drive's effectiveness will depend on community auditing of the firmware and the continued availability of the CH569 microcontroller. Future iterations may focus on increasing throughput or expanding the variety of spoofable vendor IDs to maintain its stealth profile against evolving forensic tools.