Mobile forensics has always involved having a “Plan B” (and more besides) for the all too frequent occasions when standard acquisition techniques don’t work. Locked devices and models which aren’t supported for a physical extraction within forensic tools often need just such a backup plan. We’re delighted to be launching a new course for exactly those devices in 2016.
Our new 4 day “eMMC Device Forensics” course will teach delegates how to utilise ‘Direct eMMC’ (also known as In-system Programming or ISP) to perform physical extractions of Android & Windows Phone handsets & tablets which may not be possible with commercial forensic tools. Not only that, the techniques can be applied to many TomTom satnav units as well as a range of other devices which use eMMC flash memory chips internally. Direct eMMC is similar to JTAG in that it is a non-destructive method for performing a physical extraction via connections on the printed circuit board of the device. Direct eMMC may be possible on devices where JTAG is not supported (or may not be possible due to damage to the device) meaning that less devices fall into the “too difficult” pile.