An article and a presentation identifying practices and concepts. Both contain add-value content with respect to the subject matter
Showing posts with label chip off. Show all posts
Showing posts with label chip off. Show all posts
Monday, April 22, 2013
Chip Off, JTAG, NAND and YAFFS2
Chip Off, JTAG, NAND and YAFFS2
An article and a presentation identifying practices and concepts. Both contain add-value content with respect to the subject matter
An article and a presentation identifying practices and concepts. Both contain add-value content with respect to the subject matter
Tuesday, November 20, 2012
Mobile Flash Data Erasure
Mobile Flash Data Erasure
Photo courtesy of Blancco
The growth in smart phones naturally means consumers will see even more utilities and tools similiar to those found on PCs, laptops and notebooks etc. A trend that is growing in relation to cleansing of personal details and company information stored logically and physically is called mobile flash data erasure (MFDE).
Service erasure
A group called www.tabernus.com/ promote "Tabernus also provides erasure solutions for Mobile Phones, USB, SSD (solid state devices) & other types of Flash removable memory and may other data holding devices too!"
Software erasure
Of course, there is a comparison for mobile phone flash erasure available from http://www.blancco.com/us/erase-smartphones/
The above examples are in addition to hardware encryption:
Device specific denied data access
Hardware Encryption: The iPhone 3GS and later, and all iPads, support built-in hardware encryption. All user data can be automatically encrypted in hardware at all times. This is used primarily for wiping the device rather than to stop attacks. Erasing the entire flash storage would be slow, so instead wiping works by destroying the encryption key, which instantly makes all user data inaccessible (Securosis).
And flash memory management:
Flash Memory Management Systems
Wear leveling ( http://en.wikipedia.org/wiki/Wear_leveling ) as well routines used in garbage collection solutions ( http://en.wikipedia.org/wiki/Garbage_collection_%28SSD%29#Garbage_collection and http://en.wikipedia.org/wiki/Garbage_collection_%28computer_science%29 ) can lead to potential loss due to overwriting existing deleted data.
From an examiner's point of view, MFDE is most likely to have a huge impact on deleted data recovery (DDR) from flash chips. The methodology and science behind Chip Off and JTAG is currently used for recovery of deleted data from a range of mobile devices. Overwriting 0101010101 (zeros and ones) or null values over particular areas or the entire area of the flash memory may make Chip Off and JTAG redundant in certain types of investigations and cases in the future.
Sunday, November 11, 2012
iPhone Secret Folder
iPhone Secret Folder
Opening the taps on this one could prove useful:
https://itunes.apple.com/us/app/secrets-folder-pro-lock-your/id566516598?mt=8
Opening the taps on this one could prove useful:
https://itunes.apple.com/us/app/secrets-folder-pro-lock-your/id566516598?mt=8
Saturday, April 14, 2012
Examination Techniques7: Bluetooth Headset
Examination Techniques7: Bluetooth Headset
Examiners may find it useful to be reminded to obtain a copy the bluetooth headset (DUT) user guide prior to examination. There are numerous reasons and some of these observations may prove fruitable.
1. A common headset feature that can be enabled for a particular headset is pairing with a primary device and a secondary device. This can mean a particular headset working with two mobile phones (at the same time???), or other devices such as laptops, PCs and PDAs.
2. As the identity of a headset is broadcast and then maybe associated to a target handset and/or another device (and not normally the other way around) understanding the identities in the bluetooth broadcast, is relevant, as is the bluetooth standard used by the headset can be equally as important.
3. Powering on a headset (DUT) can also reveal on certain makes/models the remaining battery level. Some headsets e.g. HM1200 require the examiner to press and HOLD the talk button and the volume button at the time forcing the headset to respond using a sequence of LED 5 flashes in a particular colour to identify the level (as a percentage) of charge remaining in the battery.
The above points are so often over looked in evidence, but can produce important facts or inferences about evidence that maybe relevant to a case.
An additional point, not connected with the user guide. If an examiner intends to perform a chip-off examination then a word of caution. The lettering/digits printed for chip identitification on some of the memory chips are so small an examiner may need a microscope (e.g. with software in order to display image results on a computer screen ).
Examiners may find it useful to be reminded to obtain a copy the bluetooth headset (DUT) user guide prior to examination. There are numerous reasons and some of these observations may prove fruitable.
1. A common headset feature that can be enabled for a particular headset is pairing with a primary device and a secondary device. This can mean a particular headset working with two mobile phones (at the same time???), or other devices such as laptops, PCs and PDAs.
2. As the identity of a headset is broadcast and then maybe associated to a target handset and/or another device (and not normally the other way around) understanding the identities in the bluetooth broadcast, is relevant, as is the bluetooth standard used by the headset can be equally as important.
3. Powering on a headset (DUT) can also reveal on certain makes/models the remaining battery level. Some headsets e.g. HM1200 require the examiner to press and HOLD the talk button and the volume button at the time forcing the headset to respond using a sequence of LED 5 flashes in a particular colour to identify the level (as a percentage) of charge remaining in the battery.
The above points are so often over looked in evidence, but can produce important facts or inferences about evidence that maybe relevant to a case.
An additional point, not connected with the user guide. If an examiner intends to perform a chip-off examination then a word of caution. The lettering/digits printed for chip identitification on some of the memory chips are so small an examiner may need a microscope (e.g. with software in order to display image results on a computer screen ).
Sunday, February 20, 2011
Mobile Phone Chip Off
Mobile Phone Chip Off
If you have produced or know of a mobile phone chip off video showing methods and techniques for removing ICs/memory from various makes/models of mobile handsets then email (trewmte@gmail.com) your youtube link and then it can be added to the thread 'Mobile Phone Chip Off'.
UPDATED:
Thank you Paul for this N70 video
Nathan, thanks for the SonyEricsson W850 video
Another SE W850 video
Nokia UEM removal
Subscribe to:
Posts (Atom)