Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ......
-
Upload
nguyentram -
Category
Documents
-
view
220 -
download
7
Transcript of Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ......
![Page 1: Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ... DriveSavers Data Recovery, eDiscovery & Digital Forensics Santa Clara, CA August 2016 ... Why](https://reader033.fdocuments.in/reader033/viewer/2022051722/5a9dd9a37f8b9abd0a8df691/html5/thumbnails/1.jpg)
Flash & Phones
Advanced Laboratory Data Recovery from Secure Mobile Devices
Session 301-I
Presented by: Will DeLisi
DriveSavers Data Recovery, eDiscovery & Digital Forensics
Santa Clara, CA August 2016
1 DriveSavers Confidential – Do Not Forward
![Page 2: Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ... DriveSavers Data Recovery, eDiscovery & Digital Forensics Santa Clara, CA August 2016 ... Why](https://reader033.fdocuments.in/reader033/viewer/2022051722/5a9dd9a37f8b9abd0a8df691/html5/thumbnails/2.jpg)
Agenda
Santa Clara, CA August 2016
2
§ Why Data Recovery from Smartphones?
§ Lab Processes & Challenges
§ Case Study
§ Looking Forward
DriveSavers Confidential – Do Not Forward
![Page 3: Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ... DriveSavers Data Recovery, eDiscovery & Digital Forensics Santa Clara, CA August 2016 ... Why](https://reader033.fdocuments.in/reader033/viewer/2022051722/5a9dd9a37f8b9abd0a8df691/html5/thumbnails/3.jpg)
Why Smartphone Data Recovery?
Santa Clara, CA August 2016
3
§ 1 billion Apple iPhones sold • But recently flat sales
§ Billions of Android phones sold • 400+ manufacturers, 4000+ models • Activation rate 6:1 over iOS
DriveSavers Confidential – Do Not Forward
![Page 4: Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ... DriveSavers Data Recovery, eDiscovery & Digital Forensics Santa Clara, CA August 2016 ... Why](https://reader033.fdocuments.in/reader033/viewer/2022051722/5a9dd9a37f8b9abd0a8df691/html5/thumbnails/4.jpg)
Why Smartphone Data Recovery?
Santa Clara, CA August 2016
4 DriveSavers Confidential – Do Not Forward
![Page 5: Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ... DriveSavers Data Recovery, eDiscovery & Digital Forensics Santa Clara, CA August 2016 ... Why](https://reader033.fdocuments.in/reader033/viewer/2022051722/5a9dd9a37f8b9abd0a8df691/html5/thumbnails/5.jpg)
Santa Clara, CA August 2016
5
§ User and device are in motion • Phones get dropped, smashed, submerged, lost
§ Most recent data will be on phone only • Photos, videos, contacts, personal information
§ Passcodes and security • People forget passcodes • In the event of death, family or estate wants data • For forensic, legal and law enforcement
Why Smartphone Data Recovery?
DriveSavers Confidential – Do Not Forward
![Page 6: Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ... DriveSavers Data Recovery, eDiscovery & Digital Forensics Santa Clara, CA August 2016 ... Why](https://reader033.fdocuments.in/reader033/viewer/2022051722/5a9dd9a37f8b9abd0a8df691/html5/thumbnails/6.jpg)
Santa Clara, CA August 2016
6
§ But Cloud backup is (almost) FREE! • Hard to backup all data all the time to one location • “Freemium” pricing can get expensive
§ It can be confusing to manage • What data is where on what cloud service?
§ People are lazy • You have to turn it on, configure and leave it on!
Why Smartphone Data Recovery?
DriveSavers Confidential – Do Not Forward
![Page 7: Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ... DriveSavers Data Recovery, eDiscovery & Digital Forensics Santa Clara, CA August 2016 ... Why](https://reader033.fdocuments.in/reader033/viewer/2022051722/5a9dd9a37f8b9abd0a8df691/html5/thumbnails/7.jpg)
Lab Process & Challenges
Santa Clara, CA August 2016
§ Initial analysis and diagnosis • Determine if physical failure
• External trauma • Liquid exposure • Electronic issues
• Or logical issue • Passcode lockout & encryption • File Deletion • OS or file system corruption
DriveSavers Confidential – Do Not Forward
6
![Page 8: Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ... DriveSavers Data Recovery, eDiscovery & Digital Forensics Santa Clara, CA August 2016 ... Why](https://reader033.fdocuments.in/reader033/viewer/2022051722/5a9dd9a37f8b9abd0a8df691/html5/thumbnails/8.jpg)
Santa Clara, CA August 2016
§ Passcode lockout is a common problem • User forgets code or
fingerprint needs to be reconfigured
• Phone disabled from too many attempts and user risks factory reset
Logical Recovery Process
DriveSavers Confidential – Do Not Forward
8
![Page 9: Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ... DriveSavers Data Recovery, eDiscovery & Digital Forensics Santa Clara, CA August 2016 ... Why](https://reader033.fdocuments.in/reader033/viewer/2022051722/5a9dd9a37f8b9abd0a8df691/html5/thumbnails/9.jpg)
Santa Clara, CA August 2016
9
§ Encryption • iOS always on since 3GS model
• Hardware/software combination • Very difficult to exploit
• Android • ~10% with encryption enabled • Performance suffers due to
software encryption • Easier to exploit
Logical Recovery Process
DriveSavers Confidential – Do Not Forward
![Page 10: Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ... DriveSavers Data Recovery, eDiscovery & Digital Forensics Santa Clara, CA August 2016 ... Why](https://reader033.fdocuments.in/reader033/viewer/2022051722/5a9dd9a37f8b9abd0a8df691/html5/thumbnails/10.jpg)
Santa Clara, CA August 2016
10
§ File deletion • User deletes local copy of data before it
is backed up or synced to cloud
Logical Recovery Process
DriveSavers Confidential – Do Not Forward
![Page 11: Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ... DriveSavers Data Recovery, eDiscovery & Digital Forensics Santa Clara, CA August 2016 ... Why](https://reader033.fdocuments.in/reader033/viewer/2022051722/5a9dd9a37f8b9abd0a8df691/html5/thumbnails/11.jpg)
Santa Clara, CA August 2016
11
§ OS or file system corruption • Phone powers on but will not boot • May be stuck in recovery or
restore mode • Unknown issues
Logical Recovery Process
DriveSavers Confidential – Do Not Forward
![Page 12: Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ... DriveSavers Data Recovery, eDiscovery & Digital Forensics Santa Clara, CA August 2016 ... Why](https://reader033.fdocuments.in/reader033/viewer/2022051722/5a9dd9a37f8b9abd0a8df691/html5/thumbnails/12.jpg)
Physical Recovery Process
Santa Clara, CA August 2016
12
§ Device teardown & cleaning • Disassembly of device to
component level
• Inspection and cleaning of any corrosion
DriveSavers Confidential – Do Not Forward
![Page 13: Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ... DriveSavers Data Recovery, eDiscovery & Digital Forensics Santa Clara, CA August 2016 ... Why](https://reader033.fdocuments.in/reader033/viewer/2022051722/5a9dd9a37f8b9abd0a8df691/html5/thumbnails/13.jpg)
Physical Recovery Process
Santa Clara, CA August 2016
13
§ PCB diagnosis and repair • Test for faults on PCB • Remove, reflow and replace
components • Re-route circuits • Rebuild the device and recover
DriveSavers Confidential – Do Not Forward
![Page 14: Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ... DriveSavers Data Recovery, eDiscovery & Digital Forensics Santa Clara, CA August 2016 ... Why](https://reader033.fdocuments.in/reader033/viewer/2022051722/5a9dd9a37f8b9abd0a8df691/html5/thumbnails/14.jpg)
Physical Recovery Process
Santa Clara, CA August 2016
14
§ JTAG • TAPs (test access points) for
access • Trial and error • Not supported or implemented
on all devices, never on Apple
DriveSavers Confidential – Do Not Forward
![Page 15: Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ... DriveSavers Data Recovery, eDiscovery & Digital Forensics Santa Clara, CA August 2016 ... Why](https://reader033.fdocuments.in/reader033/viewer/2022051722/5a9dd9a37f8b9abd0a8df691/html5/thumbnails/15.jpg)
Physical Recovery Process
Santa Clara, CA August 2016
15
§ Chip-off and raw NAND imaging • Typically the last ditch effort • Time & labor intensive • Not all SSDs are supported • Multiple layers to reassemble into
LBA image • Encryption complicates or makes
impossible
DriveSavers Confidential – Do Not Forward
![Page 16: Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ... DriveSavers Data Recovery, eDiscovery & Digital Forensics Santa Clara, CA August 2016 ... Why](https://reader033.fdocuments.in/reader033/viewer/2022051722/5a9dd9a37f8b9abd0a8df691/html5/thumbnails/16.jpg)
Customer Case Study
Santa Clara, CA August 2016
16
§ Motorola Droid Turbo XT1254 • Cracked screen; would
not charge or boot § Army soldier lost in the
line of duty • Parents wanted data
and memories of their lost son
DriveSavers Confidential – Do Not Forward
![Page 17: Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ... DriveSavers Data Recovery, eDiscovery & Digital Forensics Santa Clara, CA August 2016 ... Why](https://reader033.fdocuments.in/reader033/viewer/2022051722/5a9dd9a37f8b9abd0a8df691/html5/thumbnails/17.jpg)
Customer Case Study
Santa Clara, CA August 2016
17
§ Repaired PCB • Rebuilt into a new phone body
§ Phone now boots but locked with swipe code § Chip-off process best chance to get access
DriveSavers Confidential – Do Not Forward
![Page 18: Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ... DriveSavers Data Recovery, eDiscovery & Digital Forensics Santa Clara, CA August 2016 ... Why](https://reader033.fdocuments.in/reader033/viewer/2022051722/5a9dd9a37f8b9abd0a8df691/html5/thumbnails/18.jpg)
Customer Case Study
Santa Clara, CA August 2016
18
§ SanDisk eMMC NAND • Chip removed and cleaned
§ Extract NAND raw image § Decode and create “best effort” LBA § Recover file system and verify data § Return recovered data, and son’s
memories to the parents
DriveSavers Confidential – Do Not Forward
![Page 19: Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ... DriveSavers Data Recovery, eDiscovery & Digital Forensics Santa Clara, CA August 2016 ... Why](https://reader033.fdocuments.in/reader033/viewer/2022051722/5a9dd9a37f8b9abd0a8df691/html5/thumbnails/19.jpg)
What to Remember
Santa Clara, CA August 2016
19
§ Mobile devices will become more rugged and more waterproof in the future, but not fail-proof
§ The market for Smart devices and wearable technology will continue to expand, and no user will ever be completely backed up
§ If you do lose important data, contact a professional recovery lab for assistance
DriveSavers Confidential – Do Not Forward
![Page 20: Flash & Phones - Flash Memory Summit · PDF fileAdvanced Laboratory Data Recovery ... DriveSavers Data Recovery, eDiscovery & Digital Forensics Santa Clara, CA August 2016 ... Why](https://reader033.fdocuments.in/reader033/viewer/2022051722/5a9dd9a37f8b9abd0a8df691/html5/thumbnails/20.jpg)
Thank You!
Will DeLisi [email protected]
DriveSavers Data Recovery,
eDiscovery & Digital Forensics Santa Clara, CA August 2016
20 DriveSavers Confidential – Do Not Forward