-
Yihua SMD Rework Station - 2 in 1
-
Various types and sizes of screwdrivers
-
iFixit kit
-
Prying pick
-
Magnifier
-
Circuit board holder
-
Soldering wick
-
Rubbing alcohol or other solution
-
Flux
-
Solder balls
-
Plastic baggies
-
Various chip readers (examples)
-
eMCP221 socket board
-
eMCP162/186 socket board
-
eMMC153/169
-
-
Chip reader adapter, to USB
-
FTK Imager
-
Cellebrite's Physical Analyzer
 |  |
|---|---|
 |  |
 |  |
 |
Equipment
The necessary tools to perform chip-off forensics cover a wide range of items from high cost machines to low-tech items every lab should have. Some of the commonly found items include screwdrivers, tweezers, and a magnifying glass. The higher cost items required include a rework station complete with a hot air heat gun and a soldering iron. After the chip removal, an epoxy removing solution and related cleaning tools are necessary. This also includes any reballing materials such as extra balls, adhesive, and/or tools that aid in the placement of the balls. A variety of programmers and adapters are also required. There are some “universal” options which can alleviate the need to buy multiple but it is advised to have a wide array accessible. Additionally, a workstation equipped with software that can capture and interpret the raw data is essential as analyzing the data manually is difficult and incredibly time consuming. The commercial tools used for this project were FTK Imager and Cellebrite’s UFED Physical Analyzer but the following are options as well: RevEnge (Sanderson Forensics), Phone Image Carver (GetData Pty Ltd), and Cell Phone Analyzer (BKForensics).
Proper work spaces and safety measures need to be taken while completing chip-off forensics. The technique involves high heat, which can be dangerous, so the hot air gun needs a work bench space that has a holder for the gun to prevent any unplanned contact. The material and tool list to carryout chip-off forensics is lengthy and includes some small parts. The work area must be large enough for all of the materials but clean and organized so that during execution, items are easily accessible and small parts are not misplaced.
It would be reasonable to have different areas in the work space for the multiple stages of chip-off forensics. This could look like the following: 1) area for mobile phone breakdown including all of the opening tools necessary and allocated space to put removed mobile device parts 2) area to heat and desolder the chip that is safe and well-lit 3) area to clean the chip so that the solution is controlled and does not wet any other materials and 4) a workstation area to extract data from the chip and analyze it.