Scribd Logo
Upload

Welcome to Scribd!

  • Damaged em MC

    Uploaded by

    Sfawa
    23 views33 pages
    This document discusses techniques for recovering data from damaged eMMC chips used in mobile devices. It describes the structure of eMMC chips, common types of damage, and methods for analyzing the chip to extract the raw NAND data using x-rays, logic analyzers, and custom adapters. Error correction codes and data scrambling techniques used in eMMC controllers are also summarized, which must be addressed to reconstruct the original logical data.

    Original Description:

    Original Title

    Damaged Em Mc

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    This document discusses techniques for recovering data from damaged eMMC chips used in mobile devices. It describes the structure of eMMC chips, common types of damage, and methods for analyzing the chip to extract the raw NAND data using x-rays, logic analyzers, and custom adapters. Error correction codes and data scrambling techniques used in eMMC controllers are also summarized, which must be addressed to reconstruct the original logical data.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    23 views33 pages

    Damaged em MC

    Uploaded by

    Sfawa
    This document discusses techniques for recovering data from damaged eMMC chips used in mobile devices. It describes the structure of eMMC chips, common types of damage, and methods for analyzing the chip to extract the raw NAND data using x-rays, logic analyzers, and custom adapters. Error correction codes and data scrambling techniques used in eMMC controllers are also summarized, which must be addressed to reconstruct the original logical data.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    of 33

    THE ULTIMATE CHIP-OFF MOBILE FORENSICS:

    DATA RESURRECTION FROM DEAD EMMC CHIPS


    Rusolut

    June 3-6, 2018  Myrtle Beach, SC USA


    CHIP-OFF DATA RECOVERY FROM FLASH MEMORY DEVICES

    June 3-6, 2018  Myrtle Beach, SC USA


    RAW NAND AND EMMC CHIPS USED IN PHONES AND OTHER DEVICES
    eMMC/eMCP RAW NAND
    BGA221 BGA162 BGA186

    BGA137 BGA63 BGA107


    BGA169 12x16 BGA153/169 11,5x13 BGA153/169 10x11

    BGA169 12x18 BGA169 14x18

    June 3-6, 2018  Myrtle Beach, SC USA


    EMMC vs RAW NAND CHIP-OFF DATA RECOVERY

    RAW NAND eMMC/eMCP

    READ

    NAND protocol eMMC protocol

    READ
    June 3-6, 2018  Myrtle Beach, SC USA
    APPLICATIONS OF EMMC CHIPS

    • SMARTPHONES
    • TABLETS
    • LAPTOPS
    • VOICE RECORDERS
    • CAMERAS
    • MULTIMEDIA PLAYERS
    • TV DECODERS
    • INTERNET OF THINGS

    …AND MUCH MORE…

    June 3-6, 2018  Myrtle Beach, SC USA


    INSIDE EMMC

    EMMC PROTOCOL

    NAND PROTOCOL
    NAND MEMORY
    CONTROLLER

    June 3-6, 2018  Myrtle Beach, SC USA


    WHEN EMMC CHIP DAMAGE OCCURS

    • WATER DAMAGE

    • THERMAL DAMAGE

    • PHYSICAL DAMAGE

    • DAMAGE OF TRACKS/PADS ON CHIP’S PCB

    • DAMAGE OF WIRE BONDING INSIDE CHIP

    • HUMAN FACTOR DURING DATA RECOVERY


    SYMPTOMS OF DAMAGED EMMC CHIPS

    • NOT RECOGNIZED WHEN CONNECTED TO EMMC ADAPTER

    • RECOGNIZED BUT SHOWS WEIRD CAPACITY

    • RECOGNIZED AND FIRST 32-64MB ACCESSIBLE

    • RECOGNIZED BUT READS GARBAGE

    June 3-6, 2018  Myrtle Beach, SC USA


    SO HOW TO EXTRACT THE DATA OUT OF DAMAGED EMMC CHIP?

    June 3-6, 2018  Myrtle Beach, SC USA


    EMMC THROUGH XRAY

    CONTROLLER

    NAND MEMORY
    DELAYERED EMMC CHIP
    EMMC CHIP STRUCTURE

    CONTROLLER NAND MEMORY


    TECHNOLOGICAL PADS - NAND INTERFACE

    June 3-6, 2018  Myrtle Beach, SC USA


    NAND PINOUT ANALYSIS

    • XRAY PCB LAYOUT ANALYSIS WITH FURTHER WIRE BONDING ANALYSIS


    OF NAND AND CONTROLLER

    • NAND AND CONTROLLER PINOUT ANALYSIS THROUGH PCB LAYER


    REMOVAL

    • CLASSIC “MAN IN THE MIDDLE ATTACK” USING LOGIC ANALYZER


    CONNECTED BETWEEN CONROLLER AND NAND MEMORY

    June 3-6, 2018  Myrtle Beach, SC USA


    NAND PINOUT ANALYSIS. XRAY

    June 3-6, 2018  Myrtle Beach, SC USA


    NAND PINOUT ANALYSIS. LAYER DISSECTION – LAYER 1 (TOP)
    NAND PINOUT ANALYSIS. LAYER DISSECTION – LAYER 2 (INNER)
    NAND PINOUT ANALYSIS. LOGIC ANALYZER
    NAND PINOUT

    DATA BUS

    CONTROL
    SIGNALS
    SCENARIOS OF FAILURE

    NO SHORT CIRCUIT ~80-90% SHORT CIRCUIT ~10-20%

    • FW CORRUPTION

    • CONTROLLER DAMAGE DUE TO OVERHEAT

    • WIRE BONDING DAMAGE

    • UNKNOWN COTROLLER DAMAGES

    June 3-6, 2018  Myrtle Beach, SC USA


    SHORT CIRCUIT IN CONTROLLER. CONTROLLER DISCONNECTION. EASY CASE
    SHORT CIRCUIT IN CONTROLLER. CONNECTING TO SECOND LAYER OF PCB. HARD CASE
    EMMC-NAND ADAPTERS

    VISIT BOOTH 108 TO SEE ALL


    ADAPTERS AND TECHNOLOGY IN ACTION

    June 3-6, 2018  Myrtle Beach, SC USA


    CONNECT CHIP TO READER

    June 3-6, 2018  Myrtle Beach, SC USA


    VISUAL NAND RECONSTRUCOR – THE NEW MODE FOR EMMC-NAND ACCESS
    ADAPTER ASSEMBLY
    RAW NAND PHYSICAL IMAGE EXTRACTION

    June 3-6, 2018  Myrtle Beach, SC USA


    ERROR CORRECTION CODES IN FLASH MEMORY

    CONTROLLER

    BUFFER PROTECTED DATA


    DATA
    01010100…0111 0 1 0 1 0 1 0 0 … 0 1 1 1 0 1 0 0… 01010100…01110100
    FROM INTERFACE TO NAND MEMORY

    PARITY
    DATA

    BCH CODER

    June 3-6, 2018  Myrtle Beach, SC USA


    DATA SCRAMBLERS OF FLASH CONTROLLERS

    CONTROLLER

    XOR
    DATA RANDOMIZED DATA 0x5AF810E3
    0xBEEFBEEF +
    FROM INTERFACE TO NAND MEMORY

    0xE417AE0C
    SEED

    0 1 1 0 0 0 1

    + + +
    LFSR-BASED GENERATOR

    June 3-6, 2018  Myrtle Beach, SC USA


    LOGICAL IMAGE RECONSTRUCTION

    June 3-6, 2018  Myrtle Beach, SC USA


    SQLITE CARVING AND DATA ANALYSIS
    APPLICATIONS OF TECHNOLOGY

    • DATA RECOVERY FROM DAMAGED EMMC CHIPS

    • RETRIEVAL OF DELETED TEXT MESSAGES, CHATS , ETC. THROUGH NAND PROTOCOL INCLUDING GARBAGE BLOCKS ON
    DEEPER LEVEL THAT IS NOT ACCESSIBLE FOR CLASSIC MOBILE FORENSIC TOOLS

    More details here:


    https://www.flashmemorysummit.com/English/Collaterals/Proceedings/2017/20170808_S102A_Sheremetov.pdf
    Shortlink: https://goo.gl/g84gkJ

    June 3-6, 2018  Myrtle Beach, SC USA


    VISIT OUR BOOTH 108 TO SEE NEW TOOL UNVEIL AND TECHNOLOGY IN WORK

    THANK YOU OUR PARTNERS IN USA

    www.rusolut.com www.cprtools.com
    Polczynska 10, 2022 Hendry Street
    Warsaw, Poland Suite 100
    +48 537 202 227 Fort Myers, FL
    info@rusolut.com 239.464.DATA (3282)
    support@cprtools.com
    June 3-6, 2018  Myrtle Beach, SC USA

    You might also like