Chip-off in smartphone forensics: possibilities and limits
Chip-off is one of the best-known hardware-level methods in mobile device forensics. With current, encrypted smartphones it runs into a fundamental limit: the memory chip holds the data, but not the key.
Technically reviewed by Jan Petermann, Founder & Managing Director, smartmodPublished on
What does chip-off mean?
Chip-off refers to desoldering the memory component – in smartphones usually eMMC or UFS – and reading out its raw content with an external reader. The result is a physical image of the memory, which is then decoded and analysed.
The procedure is invasive: once the component has been desoldered, the device can no longer operate in its original state unless the component is put back in place.
When is chip-off used?
Unencrypted memory
Older smartphones and basic mobile phones without end-to-end encryption of the storage.
Memory cards and embedded systems
Memory cards, USB sticks and devices whose memory is not bound to a security area of the processor.
Devices that can no longer be operated
Devices that are so badly destroyed that they can no longer be operated – provided no encryption stands in the way of reading them out.
Why is chip-off often not enough for modern smartphones?
Current iPhones and Android devices encrypt user data by default. On current devices Android uses file-based encryption (File-Based Encryption); Apple encrypts via Data Protection with keys managed by the Secure Enclave.
In this case an image obtained by chip-off does contain the encrypted data, but not the device-bound key material. Without it, the content cannot be decrypted.
Encryption and binding to original components
The decryption keys are derived from a hardware key anchored in the device and – depending on the data class – from the passcode. The hardware key is designed so that it does not leave the security area of the processor and cannot be read out.
In practice this means: memory and processor form a unit. Only when these original components work together can the data become accessible again.
Difference between chip-off and board-level reconstruction
Chip-off
Removes the memory from the system and reads it out in isolation. Result: a raw image – on encrypted devices, ciphertext.
Board-level reconstruction
Restores the required functions of the original system so that the device works with its own keys. Result: a device that can once again be fed into a forensic extraction workflow.
ISP, JTAG and other hardware-based methods
With In-System Programming (ISP) the memory is contacted directly on the board without desoldering it. JTAG uses the processor's test and debug interfaces to access the memory. Both methods are less invasive than chip-off, but require the respective interface to be accessible.
Regarding encryption, the same applies as with chip-off: an image of an encrypted memory obtained via ISP or JTAG is likewise unreadable without the key material of the original system. In addition, on many current smartphones the debug interfaces are disabled as shipped.
When is reconstructing the original hardware the better choice?
Whenever the device encrypts its data and the components relevant to data and cryptography are still intact. The goal is then not to read out the memory, but a functioning original system that is once again available to an extraction system.
In these cases chip-off can even be counterproductive: desoldering the memory component breaks up the unit with the processor – which makes a later route via the original system more difficult.
Conclusion
Chip-off remains a valuable method for unencrypted memory, older devices and embedded systems. With modern, encrypted smartphones, by contrast, preserving the original system is as a rule decisive: board-level reconstruction restores the required functions, and extraction then takes place using established forensic methods. Which approach is right in an individual case is determined by a technical diagnosis of the specific device.
Answered briefly.
Can the memory chip of an iPhone be desoldered and read out?
Technically yes, but as a rule not in a forensically usable way. The data on current iPhones is encrypted, and the key material is bound to the Secure Enclave of the original processor. The image read out therefore contains only encrypted data.
When is chip-off still useful in mobile device forensics?
For memory without device-bound encryption – for example in older mobile phones, memory cards and some embedded systems. Whether this applies to a specific device depends on the model and software version.
Sources
- Apple: Apple Platform Security: Secure Enclave
- Android Open Source Project: File-based encryption
- NIST: SP 800-101 Rev. 1, Guidelines on Mobile Device Forensics
Related reading.
Forensic Device Recovery
Board-level reconstruction of damaged mobile devices for forensic extraction.
Learn moreForensic extraction from a damaged smartphone
Which types of damage prevent extraction and what is possible then.
Learn moreEncryption and data recovery
BitLocker, FileVault, smartphones and self-encrypting SSDs.
Learn moreWe assess whether the device can be reconstructed.
For an initial technical assessment, a few details about the device and the damage pattern are sufficient.
Wasserweg 8–10 · 60594 Frankfurt am Main