BIOS / UEFI
Definition
Firmware on a flash chip on the motherboard that runs at power-on, initialises hardware, and hands control to a bootloader. UEFI is the modern replacement for legacy BIOS and supports GPT, Secure Boot and TPM attestation.
- Location
- Flash chip on the motherboard
- Runs
- At power-on, before the operating system
- UEFI adds
- GPT support, Secure Boot, TPM attestation
- Field
- Digital forensics, hardware fundamentals
Common questions
Why does the BIOS/UEFI distinction matter to a forensic examiner?+
Boot mode determines partitioning scheme (MBR versus GPT), whether Secure Boot restricts what can run before the OS loads, and whether full-disk encryption keys are sealed to a TPM tied to firmware state. Misreading the boot mode can lead an examiner to image or interpret a disk incorrectly.
Can firmware settings themselves hold forensically relevant evidence?+
Yes. Boot order changes, Secure Boot being disabled, or an unfamiliar boot device entry can indicate tampering, an attempt to boot from external media, or a bootkit, so firmware configuration is sometimes checked and documented alongside the disk image.
Related terms
- Chipset (PCH)
- The motherboard logic that bridges CPU, RAM, PCIe lanes, SATA, USB and the firmware (UEFI/BIOS). On Intel boards the Platform Controller Hub;...
- CMOS Battery
- A small lithium cell (typically CR2032) that keeps the real-time clock and a few firmware settings alive when the system is unplugged....
- NAND Flash Wear Leveling
- The SSD controller's policy of spreading writes across physical blocks so no single block wears out first. The side effect for forensics...
- Order of Volatility
- The sequence in which digital evidence should be collected, ranked from most to least transient. Defined in RFC 3227. CPU registers and...
- TRIM
- A command issued by the file system to the flash controller identifying blocks that are no longer in use, so the controller...