Mobile Device Advanced Data Recovery Techniques
MD5 offer Advanced Data Recovery (ADR) procedures. We apply these procedures when a standard forensic process is ineffective, or if a device requires repair work prior to a forensic examination. MD5 offer the following methods which allows our analyst to extract data from handsets unsupported by forensic software, PIN/Pattern/Password protected phones and damaged or otherwise non-working handsets.
ISP (In System Programming) also known as Direct eMMC
ISP is a procedure that requires a full disassembly of the device. A connection is made to specific locations on a device Printed Circuit Board (PCB); these locations are not part of the device’s PCB’s layout. These locations exploit a direct communication with the reflected pins on the memory chip. Therefore, this procedure uses specialist software and hardware. This allows the software to exploit the memory chip pins and uses the hardware to acquire a physical image by reading the chip directly.
This does not destroy the handset; however, it is an extremely delicate procedure and there is a risk that the handset may not function as it originally did following the procedure.
Flash Memory Chip Removal (FMCR)
Flash Memory Chip Removal is also known as ‘chip off’. This procedure involves fully disassembling the device, to remove the flash memory chip on the Printed Circuit Board (PCB). Therefore, using specialist hardware and software enables the analyst to acquire a physical image.
This is a permanent and destructive processes and consequently renders the device un-useable following the procedure. Consequently, we advise this procedure should only be considered when all other forensic extraction options have been exhausted.
If a device is not functioning correctly, repairs maybe required before it can be forensically examined. Device repairs may involve taking the handset components apart meaning the device after may not work correctly after. Therefore, any advance repairs will require specific authorisation by the customer prior to any implementation.
Flash Memory Chip Transplant (FMCT)
MD5 offer FMCT as a cutting-edge, ‘last chance saloon’ experimental repair option: FMCT involves carefully removing the flash memory chip from the exhibit, removing the flash memory chip from a donor device and transplanting the chip onto the intact, previously working handset. It’s a very delicate and labour intensive procedure but has delivered some incredible results. We would normally secure test/donor devices and ensure the practice was viable before attempting the process with a live exhibit.
FMCT pushes the boundaries of the traditional ‘Chip Off’. As with Chip off, FMCT involves fully disassembling the device to locate the flash memory chip on the Printed Circuit Board (PCB) and using heat or more complex methods to remove the chip. The Chip is then cleaned up by re-balling the points on the underside. This must be done very accurately for the chip to be replaced onto another PCB (by hand). It is a very advanced procedure that requires specialist knowledge (and a very steady hand) and is only completed by our senior analysts.
Specialist hardware and software is then used to acquire a physical image which can then be decoded using Forensic Software. This is a permanent process and, while technically non-destructive, will have huge implications on the security and safety of the device moving forwards. With this regard, no warranty or guarantees are given or implied and all risks lie with the customer. MD5 do not condone the return of any device having undergone FMCT to their owner(s) and therefore, while technically the device should work, the process renders the device effectively un-useable following the procedure.
Contact us for further information on our advanced mobile phone capabilities.