The Chip Off advanced extractions from Mobile Phones is an essential skill for Forensic Examiners. Increased device security and file protection are making standard extraction methods more and more difficult. In this course, students will learn Chip-Off Extraction Techniques utilizing the heat method. You will also learn how to re-ball a chip, soldering techniques, data structures on a NAND and NOR chips, how to utilize RIFF and ORT boxes and multiple forensic software solutions that interpret the raw data dumps.
To obtain the most from this course, you should meet the following requirements:
- Able to understand course material presented in English language.
- Perform basic computer operations.
- Have basic knowledge of digital forensics.
- Have basic understanding of Microsoft Windows environment.
- Be able to perform disassembly of electronic devices.
IMPORTANT: Students should be prepared to work with potentially harmful chemicals and equipment with extremely hot surfaces that have the potential to burn skin, clothing and other materials. Students will also be working with very small parts that will require the use of visual magnification.
This course is only available in person. To enroll please contact firstname.lastname@example.org
Students attending the course have an option for discounts on software and hardware packages as well.
This course is hands on and lecture drive and the outline modules reflect this.
Module 1: Introduction
- Course Overview
- Open Source Tools
- Vendor Tools
Module 2: State of Mobile Device Forensics
- Traditional Techniques & Tools
- Advanced Extraction Methods & Scenarios
- Limitations of JTAG, Chip-Off & Direct eMMC
Module 3: Understanding Flash Technology
- Physical Characteristics & Packages
- Flash Fundamentals
- Flash Controllers
Module 4: Researching the Device & Possibilities
- Device Specifications & Online Resources
- Identifying the Processor & Flash Chips
- Support of JTAG Boxes and Programmers
Module 5: Introduction to Course Equipment
- Primary Equipment
- Supplies and Consumables
- Care and Safety
Module 6: JTAG Overview
- History & Purpose
- JTAG TAPS
- Connection Options
Module 7: NAND & RIFF Connections
- Soldering Fundamentals & Soldering to Pads
- Special Ways to Power the Device
- Using RIFF to Detect CPU
Module 8: RIFF Software
- Supported Device Profiles
- Device Detection & DCC Loaders
- RIFF Plugins & eMMC Full Flash
- Using RIFF to Read NAND
Module 9: Analysis of the NAND Image
- RIFF Image Format
- Commercial Tools and NAND Images
- Reading NAND in RAWMODE with ORT
Module 10: Practials
- JTAG Acquisition of eMMC Android Preparing
- JTAG Header and Soldering to Pads
- Use RIFF to Connect & Create Image
Module 11: Analyzing the eMMC Image Practical
Module 12: Devices Without Direct Support
Module 13: Chip-Off Overview
- History & Purpose of Chip-Off
- Preparation, Removal and Reading the Chip
- Equipment to Read the Chip
Module 14: Chip Removal
- Preparing the PCB
- Chip Underfill & Coating
- Heat Management & Solder Melting Temps
Module 15: Chip Restoration
- Evaluating & Cleaning the Chip
- Reballing Methods
- Practicals in Reballing
Module 16: Imaging with Programmers
- Universal Programmer Adapters
- UP-828 Overview
- Device Selection, Read and Validation