MD5 Case Study: Flash Memory Chip Transplant

Case Brief

Two Nokia 105 (2017) mobile phones were submitted by the client in relation to Drugs offences. Both handsets had been intentionally snapped in half by the owner in attempt to stop the client gaining access to the data.

It was not possible to power the handsets on or perform forensic extractions in the condition received.

 

     

 

Analysis and Examination

Assessment by the analyst determined that the handsets were built using MediaTek chips. These chips include both storage for the handset and the handset’s processor. Due to this it would not be possible to acquire the data using the standard Flash Memory Chip Removal process; this is where the memory chip is removed from the handset’s motherboard and then data is read directly from the removed chip.

 

  

It was determined that the memory chips would have to be transplanted onto a donor handsets to recover the data. The working donor handsets would then act in place of the original handsets to allow extraction of the original data from the chip.

The analyst then removed the memory chips from the original boards using a specialist Flash Memory Chip Removal technique. The memory chips were then manually re-balled and made ready for the Chip Transplant process.

Donor handsets were sourced by MD5; these then had the memory chips removed and the boards cleaned and repaired by the MD5 Analyst.

The Original memory chips were then transplanted onto the MD5 Donor Handset motherboards using a delicate procedure to successfully create two working handsets. It was then possible to read the handset data using standard forensic tools.

 

Results

After successfully transplanting the flash memory chip onto a donor handset it was possible to read the handset data using standard forensic tools. Contact Lists, Call Data and SMS Messages — including those marked as Deleted Data which were no longer viewable on the handsets — were then recovered from the handsets’ memory and put into an evidential report for the client.

 

Download as PDF flyer

 

  • “MD5 supported my family and I to retrieve personal information in tragic circumstances. Their care, compassion and professionalism made a huge difference to us. Personal and genuine help when we needed it most.”

  • “We all appreciate the support and help you and MD5 have provided us.  Your software and customer service help considerably in our forensic work; particularly in the preparation of evidence in a user friendly way. - A North East Police Force

  • … I just mentioned your name and how helpful you were to my Inspector.  I imaged a drive which had some positive keywords on Monday and thought I would have a look at it using vfc.  The results were extremely impressive.  It showed the suspect using a website to download illegal content and also showed the actual folders on his desktop.  Makes proving this case really easy.  Thanks again.

  • “I found your VFC Demonstration most useful as it is an area I have been discussing with a colleague and how we would be able to utilise the standalone VM to assist in communicating evidence to lay people. The addition to be able to stitch in a second drive is a brilliant addition to the product as we are now able to fully replicate the users environment rather than just their Windows installation drive. I was scratching my head as to why a user in the wild would ever want to put their paging file on another drive and can happily confirm that I have never seen it but I’m more confident we can overcome the issue thanks to your input.”

  • “VFC is a very useful tool for us as the screenshots we can show a jury far outweigh simply writing about a topic.”

  • “VFC has become an essential tool in our forensic investigator's toolkit. It provides investigators an insight into the suspect's perspective by actually seeing the user's desktop, settings and user environment. Screen captures from the suspect's ‎environment add significant weight to the forensic report when describing how the suspect utilized the computer to facilitate the crime. VFC is truly a tool that I rely upon and use in all my computer investigations!”

  • “Your assistance and eDisclosure package was very useful, it enabled me to fully review all the documents from the computers and was made available to the defence during the service of the papers.”

  • “Leader of International drugs trafficking & money-laundering ring jailed for 27 years. The ringleader behind an international multi-million-pound drugs trafficking and money-laundering ring in South Yorkshire has been sentenced to 27 years in jail. See more at: http://www.itv.com/news/calendar/update/2013-07-30/leader-of-international-drug-and-money-laundering-ring-jailed-for-27-years  ”

  • “Working with MD5 is an Absolute Pleasure.”

  • “Data received, with relief! Thanks for your efficient service and clear communication throughout.”

  • “Juries get stuck looking at our technical printouts and reports. Instead, we booted the image using VFC with judge, jury and everyone else in the court room. It was clear to see what had really happened.”

  • “VFC - A great product of real use as a forensic examiner.”

  • “I was very satisfied with MD5's performance in relation to the recent eDisclosure exercise with which they assisted.”

  • “MD5 were able to extract vital contact details from a severely fire damaged phone this proved extremely important in identifying who the phone belonged to.”

  • XERA iConect
  • Crown Commercial Service Supplier
  • Cyber Essentials Plus Certified
  • NEWA 2017
  • MSAB Logo
  • Cellbrite Logo
  • Sherlock Oxygen Forensics
  • XRY
  • Guidance Software
x
Request a Callback
  • Information supplied via this email enquiry form is handled in accordance with our Terms & Conditions. Please also refer to our website Privacy Policy.
  • This field is for validation purposes and should be left unchanged.
x
VFC Download Information
  • Information supplied via this email enquiry form is handled in accordance with our Terms & Conditions. Please also refer to our website Privacy Policy.