Source: Tech Strong Inspection (ID: techjc)
Reposting is prohibited without authorization!
With the rapid development of mobile terminal devices, the fast-paced updates, the variety of products, and the complexity of electronic devices (password settings, corrosion, water damage, violent drops, etc.), future mobile electronic forensics will face unprecedented challenges.
When encountering situations such as a broken phone, a phone that has fallen into water, a phone that cannot boot normally, a damaged phone interface, various graphic locks, third-party software locks, phone locks, PIN locks, ID locks, and other special cases, it is impossible to obtain the required effective information through simple logical means. For these special issues, JTAG technology, ISP technology, mobile storage chip imaging technology, and mobile password brute-force cracking technology are the true trump cards.
So, what technical means are commonly used in daily electronic forensics? What are their working principles? Below, I will explain in detail.
1. JTAG Technology and Working Principle
As a convenient hardware debugging interface, JTAG is widely used in embedded hardware. Its main purpose is to debug the backend programs of chips and test the performance of the entire machine by controlling the CPU to monitor the working status of the entire device. Most embedded electronic devices retain this interface prominently on the hardware circuit board from the design stage. Many smartphone motherboards also retain this interface.
This interface’s control lines are very simple, consisting of SYSTEM, TRST, TCK, TMS, TDI, and TDO, which connect directly to the relevant pins of the hardware CPU. By sending corresponding commands to the CPU through these control points, data can be received from the storage chip. Currently, the dominant CPU manufacturers in the market, such as Qualcomm, Samsung, and TI, use the JTAG mode for their low-level debugging interfaces.
When the main components of the phone (CPU, storage chip, power supply, and the connections between them) are intact, JTAG technology is easier to operate because it can be done through six control lines. In practical work, this technology can be used for image data extraction to obtain the required original evidence. It is not only simple, safe, and easy to operate but also easier to master.
2. ISP Technology and Working Principle
ISP technology, short for In-System Programming, refers to online programming technology. Currently, in the field of forensics, ISP technology can mainly be used for mobile phones with EMMC FLASH chips. The main reason for applying ISP in mobile forensics is that the process of disassembling and installing mobile FLASH is relatively complicated and requires higher technical skills from the operator. Ordinary NAND FLASH and NOR FLASH require at least nearly 20 data lines for controlling read and write operations, making them unsuitable for ISP technology. Only EMMC FLASH, which can operate with as few as six connection lines: CLK, CMD, D0, as well as two power lines and one ground line, allows for the application of ISP technology in mobile forensics.
Using ISP technology differs from JTAG technology in that the phone is not powered up as a whole; only the FLASH is powered, while the other components of the phone are not powered and do not operate. CLK is the input signal, controlled only by external instruments, while CMD and D0 are bidirectional signals. The external instrument sends read commands to the chip via CLK and CMD, D0, and FLASH provides the internal data of the chip through CMD and D0, thus completing the task of reading mobile image data, which is much faster.
3. Chip Imaging Reading Technology and Working Principle
The data of a mobile phone is stored in its memory, which consists of three parts: a SIM card, a storage card, and mobile FLASH. The mobile FLASH stores two parts of data: one part is the operating system of the phone, which includes system-level software and data, such as booting, screen display keyboard, and communication with the base station, which we generally do not care about. The other part is the application-level software data, where the forensic content we need to obtain is generally stored, such as QQ application software, QQ chat content, friend information, voice images, photos, downloaded audio and video, as well as incoming and outgoing calls, messages, etc.
In practice, regardless of the type of phone or the type of storage chip used, as long as the storage chip is not damaged, a complete image file can be obtained. Since other parts of the phone do not need to participate at all, this method is particularly effective in handling damaged phones.
The device that skillfully applies the three technologies and their working principles is the RH-6900 device, which can perform both logical extraction and low-level physical extraction of mobile phones. Even if the phone is severely damaged, it can still complete forensic tasks through JTAG, ISP, and direct chip-level extraction methods such as storage chip imaging, efficiently solving practical problems.
Recommended Reading:
1. The Difference Between JTAG and ISP Downloads
http://wenku.baidu.com/link?url=iG7JoUfNFv4vFsqpzKjPIR8xbVs2LVo_aU-qhwEEO_zCF9DIL0494cWP-v5DJHDnOB5nn3EoJAJr6ULDeMtcYcsZ9lZcXIYLxo3zijO4avy
2. Practical: Data Mining in Mobile Chip Forensics under PDU Mode
3. Phone Rooting Issues Resolved!
4. How to Recover Lost Mobile Data?
5. Mobile Chip Forensics
http://mp.weixin.qq.com/s?__biz=MzA3ODM4NTkzNg==&mid=2650986794&idx=1&sn=733307676846a0ce2ff27755b25e5b4f&scene=1&srcid=07159UdHhfffu3Aw4k4xd7V2#rd
6. Note:
WeChat Data Recovery Issues:
1) Android System: Deleted data is overwritten with 0, unrecoverable;
2) iOS System: Deleted data is not overwritten with 0, so some deleted data can be recovered.
Writing 0 operations can damage chip lifespan; for specific Flash read and write rules and principles, refer to:
A Method for Balanced Distribution of Data Storage Blocks in Flash X Technology
http://www.x-jishu.com/zhuanli/55/201210443669.html