Mobile Examination HW / SW Considerations Pt3

Mobile Examination HW / SW Considerations Pt3

The links to previous discussions are at the foot of this article. In Part 2 reference was made to six chips plus memory and how small scales integration in mobile phones was evolving, and even more quickly from year 2000 onwards. Today, we rarely see the term small scale integration used as it is all about interconnection (e.g. high density interconnection (HDI) etc) and embedded ICs. Moreover, such advancements have not been limited to working with 'um' sizes but also envolving from 2D packaging to 3D packaging.

Looking at the changes mentioned in Part 2 and the presentation by National Semiconductors illustrated six chips as separate entities. An important step forward with Fine Line Interconnection and embedded ICs was shown in year 2000 arising from a GE development called 'Embedded Chip Build-Up' (ECBU). Using materials from 1998 GE demonstrated ECBU's capability could bring scale and reformation to 'packaging' chips and enhance integrated technology for PCB manufacturing. Why is this relevant? GE's development shows how six chips are capable of inclusion in an embebbed module:

Peeling back the cover, six chips in an assembly can be revealed:

This type of GE assembly is not the only 'package'. Another notable one, below, is Freescale's Redistribution Chip Package (RCP) radio-in-a-package (2006) using four chips in an assembly with an embedded module.

So from the original six separate chips illustrated in Part 2 we see how manufacturing development, scale, and integration have migrated to chips-in-a-chip packaging. Of course, as examiners, and for the purposes of forensic discovery, how are we to approach examination of PCBs and chips used in the latest smartphone's such as iPhone, Samsung, Nokia, Android, SonyEricsson etc? 

As a start a useful guide to chip usage can be found at hardware evaluation websites, such as UBM TechInsights. The latter produce a useful overview of component identification following a mobile phone 'teardown'. 

Germane and relevant to this discussion primer is which of the iPhone chips shown in the above images are single chips and which are embedded modules containing more than one chip? If we do not understand what is inside an embedded chip how do we know whether we are missing where memory may reside?

When the term memory is referred to it does not mean memory solely relevant to data that an examiner may extract and harvest, such as 'text messages', 'phonebook' or 'internet links' etc. Mobile forensics requires and in numerous instances demands that the examiner not only know software/data memory locations but equally hardware memory locations, too.

Links
Mobile Examination HW / SW Considerations Pt1 - http://www.trewmte.blogspot.co.uk/2012/10/mobile-examination-hw-sw-considerations.html
Mobile Examination HW / SW Considerations Pt2 - http://trewmte.blogspot.co.uk/2012/10/mobile-examination-hw-sw-considerations_15.html
GE - http://www.ge.com
Freescale - http://www.freescale.com/
UBM TechInsight - http://www.teardown.com/

Mobile Examination HW / SW Considerations Pt2

Mobile Examination HW / SW Considerations Pt2

The design of memory allocation and chips in telephones may not follow a prescribed standard. However, memory is an important aspect for communications devices and an example of one telephone memory allocation in 1983 was given in Mobile Examination HW / SW Considerations Pt1 - http://www.trewmte.blogspot.co.uk/2012/10/mobile-examination-hw-sw-considerations.html.

Our interest, of course, is in mobile devices and their memory. Developments have moved us along in technology terms where we have passed through the analogue mobile phone era and into the digital era. It could be laborious for readers to be treated to a discussion about analogue mobile memory given its expiration and therefore we need to fast forward to 1996 to glimpse at memory and chipsets for GSM mobile phones.  Detail from a presentation at Handset '97 Technology Conference by National Semiconductors usefully illustrates memory allocation and chips, as shown in the image below.  

Perhaps of interest is the reference to six chips plus memory. Memory as we may commonly understand it to be can be both EEPROM and Flash. There other memory types but I don't want to stray from the discussion topic as reference to other types of memory would add nothing at this stage. We understand from Mobile Examination HW / SW Considerations Pt1 that E2PROM can be a memory of choice for electronic telephones. We see memory in use back in 1996 as observed by National Semiconductors for GSM using EEPROM and Flash. The relevance of how they were used and what went in them is of historical fact which we need not focus on that. The purpose of the observations in the National Semiconductor 1997 presentation concerned how improvements in silicon technology was enabling the possibility for even smaller scale manufacturing and to forecast how small scale integration would impact on memory and chips for future digital GSM mobile phones (see image below)

The future foreseen by National Semiconductors was the reduction in the number of chips used in mobile phones. Memory sources EEPROM and Flash are still integral requiremengts but remain separate memory allocation; and of course RAM can now be referred to. It was not shown in the earlier material above.

In the decade that followed year 2000 and up-to-date more changes and smaller scale integration has occurred. This will be considered in the next discussion so that the topic can progress towards the objective about considerations relevant to hardware and software and revelation about areas of memory that haven't been fully investigated or explored yet.