MD5 Case Study: Flash Memory Chip Transplant

Case Brief

Two Nokia 105 (2017) mobile phones were submitted by the client in relation to Drugs offences. Both handsets had been intentionally snapped in half by the owner in attempt to stop the client gaining access to the data.

It was not possible to power the handsets on or perform forensic extractions in the condition received.

 

     

 

Analysis and Examination

Assessment by the analyst determined that the handsets were built using MediaTek chips. These chips include both storage for the handset and the handset’s processor. Due to this it would not be possible to acquire the data using the standard Flash Memory Chip Removal process; this is where the memory chip is removed from the handset’s motherboard and then data is read directly from the removed chip.

 

  

It was determined that the memory chips would have to be transplanted onto a donor handsets to recover the data. The working donor handsets would then act in place of the original handsets to allow extraction of the original data from the chip.

The analyst then removed the memory chips from the original boards using a specialist Flash Memory Chip Removal technique. The memory chips were then manually re-balled and made ready for the Chip Transplant process.

Donor handsets were sourced by MD5; these then had the memory chips removed and the boards cleaned and repaired by the MD5 Analyst.

The Original memory chips were then transplanted onto the MD5 Donor Handset motherboards using a delicate procedure to successfully create two working handsets. It was then possible to read the handset data using standard forensic tools.

 

Results

After successfully transplanting the flash memory chip onto a donor handset it was possible to read the handset data using standard forensic tools. Contact Lists, Call Data and SMS Messages — including those marked as Deleted Data which were no longer viewable on the handsets — were then recovered from the handsets’ memory and put into an evidential report for the client.

 

Download as PDF flyer

 

• “MD5 supported my family and I to retrieve personal information in tragic circumstances. Their care, compassion and professionalism made a huge difference to us. Personal and genuine help when we needed it most.”

• “We all appreciate the support and help you and MD5 have provided us.  Your software and customer service help considerably in our forensic work; particularly in the preparation of evidence in a user friendly way. - A North East Police Force”