Practical Mobile Forensics - Fourth Edition

The chip-off technique

Chip-off, as the name suggests, is a technique where the NAND flash chips are removed from the device and examined to extract information. Hence, this technique will work even when the device is passcode-protected and USB debugging is not enabled. Unlike the JTAG technique, where the device functions normally after examination, the chip-off technique usually results in the destruction of the device, that is, it is more difficult to reattach the NAND flash to the device after examination. The process of reattaching the NAND flash to the device is called re-balling and requires training and practice.

Chip-off techniques usually involve the following forensic steps:

1. All of the chips on the device must be researched to ...