Data Recovery Strategies – Chip-Off and JTAG
There are two primary procedures when dealing with cellular cellular phone information restoration and flash recoveries. By interrogating the NAND memory chip, each of these strategies give data restoration engineers accessibility to a small-level impression of the information, although they are both incredibly distinct. Cellular phones, flash storage and good-condition-drives all count on memory chips for storing info in distinction to hard disk drives, which use rotating platters and study/produce heads.
When it arrives to really hard disk drives they all are inclined to use a prevalent approach to storing information, indicating that data recovery equipment can be generic. Flash units on the other hand differ a whole lot more possessing a prosperity of various information formats, file structures, algorithms, memory types and configurations, facts extractors are generally ‘device specific’. This indicates that the only way to attain a little bit for bit copy of the raw info is to interrogate the memory chips specifically, efficiently bypassing the running system. This is exactly where chip-off and JTAG technologies will come into engage in.
The initially technique is the chip-off tactic. This system demands de-soldering the memory chip from the circuitry. In order to remove the chip from the unit devoid of creating any injury it calls for precision ability underneath a microscope as making any little mistakes pitfalls shedding all the facts permanently. Following the chip is taken off it can be read through with facts extractors. NAND chips are typically substantially much easier to examine than other varieties of chip and are usually what SD playing cards and iPhones use. This is because of to the memory architecture and pin configuration being standardised. The pins are on the outside the house this means there is no want to rebuild the connectors. Other widespread styles of chip these kinds of as the BGA have many connectors on the underside which are straight soldered to the motherboard with 1000’s of diverse configurations so are considerably a lot more complicated to remove.
The second system is JTAG which doesn’t call for elimination of the chip. A info recovery engineer can occasionally obtain the memory through the JTAG ports. This is a a lot extra lengthy system and does not damage the media. This suggests it can be held in a working point out which is at times a significant need in forensic investigations. A downside of this technique is that it is not generally as prosperous and can be a riskier possibility.
Both approaches will create a minimal-stage image which is then ‘decoded’ and the user’s info can be rebuilt. Each chip-off and JTAG engineering is developing and getting a great deal more responsible that means that the good results charges of info recovery from mobile phones is practically as very good as that of tricky disk drives.
