Information Technology Reference
In-Depth Information
perienced and qualified personnel should attempt it. Any error in soldering the JTAG pads
or applying a different voltage could damage the device entirely.
Chip-off
Chip-off, as the name suggests, is a technique where the NAND flash chip(s) are removed
from the device and examined to extract the information. Hence, this technique will work
even when the device is passcode-protected and USB debugging is not enabled. Unlike
the JTAG technique where the device functions normally after examination, the chip-off
technique usually results in destruction of the device, that is, it is more difficult to reattach
the NAND flash to the device after examination. The process of reattaching the NAND
flash to the device is called
re-balling
and requires training and practice.
Chip-off techniques usually involve the following forensic steps:
1. All of the chips on the device must be researched to determine which chip con-
tains user data. Once determined, the NAND flash is physically removed from the
device. This can be done by applying heat to desolder the chip as shown in the
following image (published by
www.binaryintel.com
). This is a very delicate pro-
cess and must be done with great care as it may result in damaging the NAND
flash.
