Chip-Off Forensics

    Today’s world revolves heavily around technology. There are constantly new products and devices being created to satisfy consumer demands. One area where this is seen quite heavily is mobile devices. New cell phones are one of the hottest products to buy and they eventually contain vast amounts of user data. Due to the amount of user data and activity stored, mobile phones are often crucial sources of digital evidence in criminal and civil cases. Additionally, many users do not have security and data privacy at the forefront of their minds when using devices, which can be helpful when investigators need to analyze a mobile device.

 

    The digital forensics industry has grown exponentially over the years and has created standard commercial tools used for data recovery of mobile devices. The goal of mobile device forensics is a bit-by-bit copy of the data from the device, however; with so many products in the market, commercial tools cannot accommodate every scenario. Problems arise when cell phones are damaged (by water or hardware damage), are encrypted/protected with a passcode, or are not supported by forensic programs. In these situations, pulling data via physical or logical means will not always be successful or very helpful. Thus, investigators need to lean towards more innovative methods for a physical extraction. This can be achieved by extracting data directly from the flash memory chip on a mobile device. 

    One of the main methods for carrying out data extractions from memory chips is chip-off forensics. It is often considered a last resort for recovering data from a mobile device as it is highly destructive, however; it can yield fantastic results when all other methods have failed. Simply put, chip-off forensics is removing the memory chip from the circuit board of a device and extracting the data. The data is not in a logical format so it is difficult to analyze manually. Using digital forensics tools to analyze the data can produce SMS data, contact lists, photos, application data, etc. These results can be crucial in an investigation when evidence from a mobile device is vital to a case. It is important to note that chip off forensics is not immune to encryption or errors, which leaves the industry open to make modifications to traditional chip off forensics and create new methods.

​