AccessData User Summit 2016 April 5 th – 7 th, 2016 Lake Mary, FL The Pros and Cons of JTAG and Chip Off Extractions

Mobile Extraction Classifications 2 NIST Publication Page 18

Manual Extraction 3  Interacting with the phone “as the user would”  Pros!  Always supported if the device is unlocked  Minimal training  Great for demonstrative purposes in court. Show the content as it appears  “Low cost” of equipment  Cons!  …you’re interacting with the device…  Time consuming  Limited in the amount of information recovered.

Logical Extractions 4 Our Terms…. start to get a little loose…  Two main types of Logical extractions:  Logical  Filesystem  Logical Pros!  Wide support  Typically the output is human readable “almost ready for delivery”  Because of the above points, minimal training required. “Push button forensics”  Logical Cons!  Only allocated records (SQLite Queries)  Results are typically limited to “known applications”  Relies on App Injection: Space requirements (Android), “changing” the contents of storage, etc.

Logical Extraction – File System 5  Pulls WHOLE files and directories… except when it doesn’t  Many tools refers to device backups (iTunes/iCloud, ADB Android) as a File System extraction. (backups may not be full file systems, limited extraction)  Pros!  Full database extraction means a chance for deleted content.  Chance to find “unknown” applications and data  Cons!  Still no unallocated data  Root/Jailbreak often required (more intrusive)  More training required for parsing meta data and new applications.

Software “Physical” 6  A bridge between Logical and JTAG/Chip Off  Pros!  Bit for bit copy of user partitions  Unallocated data (if not encrypted) may be accessible.  Full directory and file listings typically returned  Cons!  Support is limited and getting more rare  Intrusive (rooting and bootloader bypass/replacements)  More advanced training required for both extraction and analysis.  Encryption if present may prevent analysis of unallocated data.

Physical Extraction (JTAG) 7  Joint Test Access Group (JTAG)  We Exploit JTAG methods/features for forensics. Storage Chip Processor OS/Security USB cmd TAPs Storage Chip cmd

JTAG - Continued 8  Pros!  Bypasses non-encryption based security (passcodes, PINs, pattern)  Full bit for bit extraction of either full chip, partitions, or byte range.  A lot of non-iOS devices are JTAG compatible  Non-destructive  Doesn’t require any software modifications to the phone  Cons!  Output is a raw binary file. File system/output support may be limited within forensic tools  Higher level of skill and training both in connection of JTAG and analysis of the resulting binary file.  If done incorrect may result in damage to the device, data, beyond recovery.

Not JTAG…but Similar, Direct eMMC 9  Is System Programming (ISP) includes Direct eMMC reads.  Similar to JTAG: Non destructive, soldered wires, similar boxes/software and output.  …different ->  Pros!  Faster than JTAG  Not Destructive  Cons!  Requires knowledge of the processor pinout (often difficult to find)  May be difficult to find where the circuit surfaces on the PCB  MUCH smaller contact points to solder to. (Increased solder skill)  May require an increased monetary investment (test devices) Storage Chip PCB Surface Contacts

Direct eMMC 10

Direct eMMC 11 Courtesy: Joann Gibb (Ohio BCI)

Chip Off 12  Accurately named… the method refers to the removal of the physical chip from the motherboard of the device, then reading the contents of the chip through specialized equipment called programmers.  Also not natively a forensic process. The programmers used are “smaller” versions of what chip manufacturers use to configure, format and test their chips. …we simply do it in reverse.

Chip Off Continued 13  Pros!  Captures a bit for bit image of the chip (includes system and spare areas)  “Most forensically sound” method. Closest to dead box computer forensics. “Just as it was”  Can be used on severely damaged devices.  Device doesn’t need to powered or booted (JTAG often requires power/boot)  Cons!  Device (not the chip) is destroyed in the process. No going back!  Significant monetary investment into equipment (continuing)  Requires a high level of training and practice (an art!)  Risk of damage to the chip due to high heat.  Encryption still an issue.

Chip Off - Example 14

Chip Off - Example 15

Chip Off Continued 16

Micro Read 17  Use of an Electron Microscope to read the state of each gate individually to reconstruct the contents of the chip.  Pros!  Accurate bit for bit (and in this case, bit by bit) copy of the storage chip.  Can compensate for EXTREME damage to the device, and even some damage to the storage chip.  Cons!  Well… it’s still theoretical. No known agencies doing it  Extremely expensive  Extreme high level of training and proprietary knowledge needed  Time consuming (understatement)