Authors: Aya Fukami, Saugata Ghose, Yixin Luo, Yu Cai, Onur Mutlu
DFRWS EU 2017
Abstract
Digital forensic investigators often need to extract data from a seized device that contains NAND flash memory. Many such devices are physically damaged, preventing investigators from using automated techniques to extract the data stored within the device. Instead, investigators turn to chip-off analysis, where they use a thermal-based procedure to physically remove the NAND flash memory chip from the device, and access the chip directly to extract the raw data stored on the chip.