The chip-off data recovery & digital forensics methodology used in cases when data access through standard device interface is not possible (physical, electrical, FW or other damage).
In such cases it’s necessary to unsolder the NAND flash memory chip, because it contains all the user’s data. In most of damage incidents the NAND chip remains fully functioning.
There’s vast variety of packages of modern NAND chips exist (TSOP48, TLGA52, BGA100, BGA152, etc.). In order to read physical image of data out of memory chip it’s necessary to choose appropriate adapter from Visual Nand Reconstructor kit.
When the flash chip is connected to adapter it’s necessary to connect this assembly to VNR Reader and read physical image (dump) to a file.
In order to extract data the physical image must be converted to logical image, because controller transforms data in transfer channel according to its configuration. Firstly, all data transformations brought by flash controller must be removed.
And secondly, virtual blocks must be filtered and sorted in logical sequence, using adjustable Block translation algorithm of VNR.
At the end of process when physical image converted to logical image, it is a time to save user’s files or the whole file system image for further forensical analysis.