Chip-Off Forensics

1. Obtain mobile device

2. Complete teardown of mobile device

3. Locate and research the memory chip on the circuit board

4. Place circuit board in holder

5. Heat and remove the memory chip

6. Let the chip cool

7. Clean the chip with a soldering wick and soldering iron

8. Remove residue from the chip using cleaning solution

9. Select compatible chip adapter* and place chip in it

10. Connect the adapter to a workstation

11. Use FTK Imager (or dd for Linux system) to make an image of the chip

12. Detach the chip reader, remove the chip and place it in a safe location

13. Use Cellebrite's Physical Analyzer to interpret the image

​​

*Steps involve using an adapter and software to image the chip as opposed to an adapter and a programmer.