Flash Memory Chip Removal (“chip off”)
Advanced Level | 4½ days
Password-protected, damaged and unsupported devices can pose significant challenges to digital forensic units tasked with evidence recovery. In some situations the only viable option for recovery of evidence is the removal and reading of flash memory chips located within the device (“chip-off”); a service provided by a limited number of commercial providers. With the majority of modern devices utilising eMMC flash memory chips, chip-off has established itself as a cost effective method for dealing with locked and unsupported Android & Windows Phone devices.
Successful removal of flash memory chips requires appropriate equipment and skilled techniques to ensure that the chip is not damaged during removal and that a full read of the device can be obtained. Flash Memory Chip Removal is a 4½ day course designed to teach delegates how to identify flash memory chips within electronic devices, safely de-solder these chips and extract the data they contain.
Specifically, delegates will learn techniques to assist in re-soldering flash memory chips to the device circuit board after data has been extracted from the chip. This process is ideally suited to locked devices where the PIN or password can be recovered from the extracted data and then entered into the re-assembled device in order to perform a manual or logical extraction.
Delegates will work with Android and Nokia Lumia models for which physical extractions cannot be performed with commercial forensic tools or direct eMMC (ISP) as these devices are most likely to require chip-off in order to extract data. In addition, delegates will gain experience in removing and reading UFS chips from the Samsung Galaxy S6 handset.
What you will learn
By the end of the course, students will be able to:
- Safely remove eMMC and proprietary flash memory chips from printed circuit boards
- Successfully clean and “re-ball” flash memory chips in preparation for data recovery
- Recover the contents of flash memory chips using appropriate software and hardware
- Explain & justify their actions in court
Who should attend?
Although previous experience of working with raw hex data from digital devices would be advantageous, it is not essential. Due to the close-up nature of the work, it is essential that delegates have very good eyesight and a steady hand! Previous experience of soldering would be beneficial but is by no means essential.