Summary
Retrieves HP Endpoint Security Controller Bootlog Evidence
Syntax
Get-HPEpscBootlogEvidence [-Nonce <Byte[]>] [<CommonParameters>]
Get-HPEpscBootlogEvidence -InFile <String> [<CommonParameters>]
Get-HPEpscBootlogEvidence [-Nonce <Byte[]>] -OutFile <String> [<CommonParameters>]
Description
This command retrieves HP Endpoint Security Controller (EpSC) bootlog evidence that contains attestation data about the system boot process. The evidence includes cryptographic signatures and measurements that can be used to verify the integrity and authenticity of the boot sequence.
The cmdlet can operate in different modes:
1. **BIOS Extraction Mode**: When neither -InFile nor -OutFile are specified, the cmdlet retrieves evidence directly from the EpSC on the current system using a random nonce.
2. **BIOS Extraction with Custom Nonce**: When -Nonce parameter is provided, the cmdlet uses the specified 32-byte nonce for evidence generation.
3. **BIOS Extraction with File Output**: When -OutFile parameter is provided, the raw evidence data is saved to the specified file in addition to returning the parsed evidence object.
4. **File Input Mode**: When -InFile parameter is provided, the cmdlet loads and parses evidence from the specified binary file instead of extracting from the current system.
**DEPENDENCY**: HP Endpoint Security Controller Gen5 is required if evidence is being retrieved from EpSC on the current platform.
Parameters
| Name | Argument | Description |
|---|---|---|
| Nonce | <Byte[]> | A 32-byte array to be used as the input nonce for HP EpSC evidence generation. This parameter is optional and only used when the EpSC evidence is retrieved directly from the HP EpSC component on the target system. The HP EpSC will include this nonce in the evidence to confirm the evidence is fresh and not a replay of old evidence. |
| InFile | <String> | If this parameter is present, the HP EpSC bootlog evidence will be loaded from the specified binary format file instead of loading from the current system. This parameter is optional and mutually exclusive with -OutFile and -Nonce. |
| OutFile | <String> | If this parameter is present, the raw HP EpSC bootlog evidence (retrieved from the current system's EpSC) will be saved to the specified file name in binary format. This parameter is optional and mutually exclusive with -InFile. |
Examples
PS C:\> Get-HPEpscBootlogEvidencePS C:\> $nonce = [byte[]](1..32 | ForEach-Object { [byte](Get-Random -Minimum 0 -Maximum 256) })
PS C:\> Get-HPEpscBootlogEvidence -Nonce $noncePS C:\> Get-HPEpscBootlogEvidence -InFile "C:\Users\Tools\Test\HpEpscBootlogEvidence.bin"PS C:\> Get-HPEpscBootlogEvidence -OutFile "C:\Users\Tools\Test\HpEpscBootlogEvidence.bin"PS C:\> $nonce = [byte[]](1..32 | ForEach-Object { [byte](Get-Random -Minimum 0 -Maximum 256) })
PS C:\> Get-HPEpscBootlogEvidence -Nonce $nonce -OutFile "C:\Users\Tools\Test\HpEpscBootlogEvidence.bin"Notes
**DEPENDENCY**: HP Endpoint Security Controller Gen5 is required if evidence is being retrieved from EpSC on the current platform
- This command requires an HP system with Endpoint Security Controller (EpSC) support
- When extracting from EpSC, the command requires appropriate system permissions
- The nonce parameter must be exactly 32 bytes when specified- Binary evidence files should contain valid EpSC bootlog evidence data
- Evidence data includes cryptographic signatures that can be validated using Invoke-HPEpscBootlogEvidenceValidation
- Both -InFile and -OutFile should not be used together