Information Technology Reference
In-Depth Information
The chip-off technique
2. The chip is then cleaned and repaired to make sure that the connectors are present
and functioning.
3. Using specialized hardware device adapters, the chip can now be read. This is
done by inserting the chip into the hardware device, which supports the specific
NAND flash chip. In this process, raw data is acquired from the chip resulting in
a
.bin
file.
4. The data acquired can now be analyzed using forensic techniques and the tools
described earlier.
The chip-off technique is most helpful when the device is damaged severely, locked, or
otherwise inaccessible. However, the application of this technique requires not only ex-
pertise but also costly equipment and tools. There is always a risk of damaging the NAND
flash while removing it and hence it is recommended to try out the logical techniques first
to extract any data.
