Private customersBusiness & public sector
Send in
Forensics · Damaged mobile devices

Forensic extraction from a damaged smartphone: what options are there?

A physically damaged smartphone can prevent a forensic extraction even though the stored data itself is still present. Whether it becomes accessible again is usually decided not by the memory chip, but by the condition of the rest of the original hardware.

Technically reviewed by Jan Petermann, Founder & Managing Director, smartmodPublished on

When does hardware become a problem for forensics?

Forensic extraction systems require a device that boots, communicates via its interface and – depending on the method – can be put into a specific operating mode. If one of these prerequisites fails, the extraction fails before it has begun.

The problem then lies not in the software of the extraction system, but in the hardware of the evidence item. The data may be fully present – it is just not accessible via the regular route.

Which damage prevents a regular extraction?

  • Liquid

    Liquid ingress causes short circuits and triggers corrosion that continues to progress even after drying – especially with salt water or contaminated liquids.

  • Corrosion

    Corrosion interrupts traces and solder joints, often under shielding cans and components, where it is not visible from the outside.

  • Fire and heat

    Heat damages components, solder joints and the circuit board itself. What matters is whether the data- and cryptography-relevant components have survived the temperature.

  • Mechanical destruction

    Broken or bent logic boards, torn-off components, destroyed connectors. In multilayer boards, inner traces can crack without this being visible from the outside.

  • Power supply faults

    Short circuits on supply lines (power rails) or defective power management ICs prevent the device from booting at all.

  • Defective interfaces

    Damaged USB-C or Lightning ports, flex cables or interface ICs: the device may boot under certain circumstances, but does not establish a data connection to the extraction system.

Why does simply “reading out the memory” often not work on modern smartphones?

Current iPhones and Android smartphones encrypt user data by default. The keys are derived from device-bound key material and – depending on the data class – the passcode. The device-bound material is anchored in a security area of the system: at Apple in the Secure Enclave, on Android in hardware-backed key management.

If the flash memory is desoldered and read out outside the device, the result is therefore as a rule only encrypted content. The key that would make it readable remains in the original system.

What role does the original hardware play?

Because data access is bound to the original system, preserving it is, on modern smartphones, usually the prerequisite for any further work. The data- and cryptography-relevant components – typically the main processor with its security area and the flash memory – must remain functional and work in their original combination.

Replacing the entire logic board does not solve the problem: together with the board, precisely those components to which the data is bound would be gone.

Before any intervention

Do not charge or switch on devices with liquid or fire damage. Any current flowing through a damaged board can destroy further components – including those that are essential for data access.

What is board-level reconstruction?

Board-level reconstruction refers to restoring the required functions directly on the original device board. The goal is not a device fit for everyday use, but a state in which the original hardware is accessible again for a forensic extraction.

  • Diagnosis

    Microscopic examination and electrical measurement – short circuits, supply voltages, interrupted connections.

  • Trace and solder joint repair

    Restoring interrupted connections by microsoldering.

  • Replacement of non-data-relevant components

    For example in the power supply or interface area – the data- and cryptography-relevant components remain untouched.

  • BGA rework

    Desoldering and resoldering components whose contacts are solder balls beneath the package.

  • Component transplantation

    If the original board can no longer be saved, the data- and cryptography-relevant original components can – as far as technically possible – be transferred to an intact carrier board of the same model.

When are chip-off, ISP or other methods an option?

Hardware-level methods such as chip-off, in-system programming (ISP) or JTAG access the memory or debug interfaces directly. They are established for older or unencrypted devices, for basic mobile phones, for memory cards and for embedded systems.

On current, encrypted smartphones they usually only deliver encrypted raw data, for the reasons given above. Which method is an option in an individual case depends on the device, software version and damage pattern – there is no blanket recommendation.

What happens after a successful reconstruction?

Once the required function has been restored – such as the ability to boot or data communication – the device is passed on to the forensic extraction workflow: in the client’s lab or, by arrangement, in the reconstructing lab.

Hardware reconstruction and forensic extraction are separate work steps. A successful reconstruction does not guarantee data access: whether device locks or encryption can be overcome depends on the model, operating system version, device condition and the available forensic methods.

The hardware interventions performed should be documented on a per-case basis, so that it remains traceable in what condition the evidence item was received, processed and handed over.

What information does the lab need for an initial assessment?

  • Device

    Manufacturer and model, as far as known.

  • Damage pattern

    Liquid, fire, mechanical destruction, electrical fault – and since when.

  • Current condition

    Does the device respond to power, does the display show anything, is it recognised by a computer or the extraction system?

  • Previous measures

    Drying, repair, data recovery or extraction attempts.

  • Photos

    Of the device and – if already opened – of the board. No personal investigation documents, unless they are required for the technical assessment.

  • Deadlines

    If a deadline is running, it belongs in the first message.

Common questions

Answered briefly.

Can a smartphone with water damage be forensically extracted?

Often yes, especially if it reaches a lab quickly. Corrosion continues to progress after contact with liquid, and attempts to switch it on or charge it can cause additional short circuits. Only a board-level diagnosis shows whether the functions required for the extraction can be restored.

Does it help to swap the logic board of a damaged smartphone for a working one?

No. On modern smartphones the data is bound to components of the original board. With a replacement board a device will boot again, but without access to the original data.

Sources

  1. NIST: SP 800-101 Rev. 1, Guidelines on Mobile Device Forensics
  2. Apple: Apple Platform Security: Data Protection overview
  3. Android Open Source Project: File-based encryption
Read on

Related reading.

Forensic Device Recovery

Board-level reconstruction of damaged mobile devices for forensic extraction.

Learn more

Chip-off in smartphone forensics

Possibilities and limits of the method on encrypted devices.

Learn more

IT forensics & digital evidence preservation

Forensic preservation and analysis of intact storage media and mobile devices.

Learn more
Damaged evidence?

We assess whether the device can be reconstructed.

For an initial technical assessment, a few details about the device and the damage pattern are sufficient.

Have damaged evidence assessed →← Data recovery

Wasserweg 8–10 · 60594 Frankfurt am Main