MD5 Case Study: Flash Memory Chip Removal Water Damaged Phone

Case Brief

A Blackberry Bold 9790 mobile phone was submitted by the client in an attempt to explain the disappearance of a young man. The handset was found in the sea at the foot of a cliff. The IMEI number of the phone identified that it had belonged to the missing person. The handset had been submersed in salt water for several weeks.

It was not possible to power the handsets on or perform forensic extractions in the condition received.


Analysis and Examination

Assessment by the analyst determined the handset would not power on safely (and highly unlikely it would power on at all) so it was disassembled.
Due to the damage to the motherboard, neither JTAG nor ISP techniques would work on this model so our Analyst opted for a chip removal process and a direct read of the memory chip to get a full ‘physical download’ or binary dump of the device.


As a precaution, our Analyst also specially prepared the Printed Circuit Board (PCB) to ensure the chip would not be further compromised during the chip removal process. The device and components were cleaned and dried using specialist forensic techniques to ensure clean contact with the pins and to maximise the chances of a positive data dump.

Prior to cleaning, neither the 16GB memory card or SIM card would read but this process enabled a full download of data from both components.



The chip was successfully removed, cleaned up, prepared under a microscope and then read using specialist hardware. The acquired data was decoded and text messages, photos and other key data were found on the handset which gave our client and the victim’s family some important insight into what may have happened immediately prior to the phone being lost.


Download as PDF flyer

  • “MD5 supported my family and I to retrieve personal information in tragic circumstances. Their care, compassion and professionalism made a huge difference to us. Personal and genuine help when we needed it most.”

  • “We all appreciate the support and help you and MD5 have provided us.  Your software and customer service help considerably in our forensic work; particularly in the preparation of evidence in a user friendly way. - A North East Police Force

  • … I just mentioned your name and how helpful you were to my Inspector.  I imaged a drive which had some positive keywords on Monday and thought I would have a look at it using vfc.  The results were extremely impressive.  It showed the suspect using a website to download illegal content and also showed the actual folders on his desktop.  Makes proving this case really easy.  Thanks again.

  • “I found your VFC Demonstration most useful as it is an area I have been discussing with a colleague and how we would be able to utilise the standalone VM to assist in communicating evidence to lay people. The addition to be able to stitch in a second drive is a brilliant addition to the product as we are now able to fully replicate the users environment rather than just their Windows installation drive. I was scratching my head as to why a user in the wild would ever want to put their paging file on another drive and can happily confirm that I have never seen it but I’m more confident we can overcome the issue thanks to your input.”

  • “VFC is a very useful tool for us as the screenshots we can show a jury far outweigh simply writing about a topic.”

  • “VFC has become an essential tool in our forensic investigator's toolkit. It provides investigators an insight into the suspect's perspective by actually seeing the user's desktop, settings and user environment. Screen captures from the suspect's ‎environment add significant weight to the forensic report when describing how the suspect utilized the computer to facilitate the crime. VFC is truly a tool that I rely upon and use in all my computer investigations!”

  • “Your assistance and eDisclosure package was very useful, it enabled me to fully review all the documents from the computers and was made available to the defence during the service of the papers.”

  • “Leader of International drugs trafficking & money-laundering ring jailed for 27 years. The ringleader behind an international multi-million-pound drugs trafficking and money-laundering ring in South Yorkshire has been sentenced to 27 years in jail. See more at:  ”

  • “Working with MD5 is an Absolute Pleasure.”

  • “Data received, with relief! Thanks for your efficient service and clear communication throughout.”

  • “Juries get stuck looking at our technical printouts and reports. Instead, we booted the image using VFC with judge, jury and everyone else in the court room. It was clear to see what had really happened.”

  • “VFC - A great product of real use as a forensic examiner.”

  • “I was very satisfied with MD5's performance in relation to the recent eDisclosure exercise with which they assisted.”

  • “MD5 were able to extract vital contact details from a severely fire damaged phone this proved extremely important in identifying who the phone belonged to.”

  • XERA iConect
  • Crown Commercial Service Supplier
  • Cyber Essentials Plus Certified
  • NEWA 2017
  • MSAB Logo
  • Cellbrite Logo
  • Sherlock Oxygen Forensics
  • XRY
  • Guidance Software