Data Recovery Application from NAND Flash Memories Using the Chip-Off Technique in Digital Forensics
Öz
In digital forensics, retrieving data from physically damaged or inaccessible devices is critical for evidence preservation. This study presents a detailed application of the chip-off technique for data recovery from NAND flash memories. The process involves the physical removal of a TSOP-48 NAND chip from a defective SanDisk flash drive, followed by cleaning, preparation, and raw data extraction using the PC-3000 Flash platform. Each stage — including soldering temperature adjustment, pin cleaning, ECC correction, and XOR decoding — is described step by step to ensure repeatability and data integrity. Experimental findings show that using optimal rework parameters (380 °C, 30 % airflow) and proper flux (Amtech NC-559-ASM) allows for complete and error-free data recovery. The study emphasizes the importance of standardized chip-off procedures in forensic laboratories and provides practical guidance for minimizing physical and logical errors during the recovery of NAND-based storage devices.
Anahtar Kelimeler
Kaynakça
- Axelson, J. (2006). USB mass storage: designing and programming devices and embedded hosts. lakeview research llc.
- Bez, R., Camerlenghi, E., Modelli, A., & Visconti, A. (2003). Introduction to flash memory. Proceedings of the IEEE, 91(4), 489-502.
- Chang, Y.-H., Lin, J.-H., Hsieh, J.-W., & Kuo, T.-W. (2010). A strategy to emulate NOR flash with NAND flash. ACM Transactions on Storage (TOS), 6(2), 1-23.
- Ence, C., & Cantrell, G. (2018). Chip-off success rate analysis comparing temperature and chip type. The Journal of Digital Forensics, Security and Law: JDFSL, 13(4), 33-59.
- Ence, C., Runs Through, J., & Cantrell, G. D. (2019). Chip-off Success Rate Analysis Comparing Temperature and Chip Type. Journal of Digital Forensics, Security and Law, 13(4), 7.
- Fukami, A., Ghose, S., Luo, Y., Cai, Y., & Mutlu, O. (2017). Improving the reliability of chip-off forensic analysis of NAND flash memory devices. Digital Investigation, 20, S1-S11.
- Fukami, A., & Nishimura, K. (2019). Forensic analysis of water damaged mobile devices. Digital Investigation, 29, S71-S79.
- Hasan, M. M., & Ray, B. (2020). Data recovery from {“Scrubbed”}{NAND} flash storage: Need for analog sanitization. 29th USENIX security symposium (USENIX Security 20),
- Lakkoju, N. K., Gudla, S., & Mantravadi, B. S. (2011). AVR-USB data acquisition. 2011 3rd International Conference on Electronics Computer Technology,
- Li, Q., Wang, Q., Yang, L., Yu, X., Jiang, Y., He, J., & Huo, Z. (2022). Optimal read voltages decision scheme eliminating read retry operations for 3D NAND flash memories. Microelectronics Reliability, 131, 114509.