Chip-Off Forensics

Conclusion

    Chip-off forensics is a technique requiring very specialized skills and equipment. It is high risk and can be difficult to conduct but can yield data of high evidentiary value in a forensic investigation. It is a helpful technique in that it is the absolute last resort for data recovery. Additionally, the device does not need to have to power (like with other methods such as JTAG), thus expanding the scenarios in which chip-off can be performed. As “the device is not “booted” [there is] little possibility of data changes”, ensuring the examiner extracts the most data possible (MPE+). The process can be accomplished relatively quickly at around 30 minutes.

​

    Chip-off forensics also faces many challenges. As it is the last resort for data extraction, there is a lot of pressure on the examiner when performing the technique. The entire chip-off process must be completed precisely as there is much room for devastating error. The heat involved can cause high stress on the flash memory chip so the temperature and delivery of the heat must be heavily controlled which can be difficult. Overall, chip-off is highly invasive and destructive of the target device. In order to counteract some of the damage done, a sometimes extensive cleaning and potentially reballing process must be carried out as well. Cost is also a big factor in the feasibility of using this technique. The necessary equipment, particularly the adapters, are costly requiring labs and examiners to choose between keeping cost down or expanding support to more phones and chips. Finally, encryption is a problem that chip-off cannot solve. Even if data is successfully extracted from a chip, “the contents of the files would still be encrypted” (Edwards et al.). While many problems can be encountered during chip-off, the value of the last resort technique is not diminished and it will continue to be a highly depended upon method of data extraction.