What is ‘Chip Off’ Data Recovery and how can it be used in forensics

In the ever-evolving landscape of digital forensic technology, the need for effective and advanced methods of data extraction in forensic investigations has become paramount. One such technique gaining prominence is “chip-off” forensics, a method that involves physically removing memory chips from electronic devices to access and recover crucial data. In this article we introduce ‘Chip off’, how it is performed and explore what can be done with the technology.  

Chip-off forensics is a specialised approach used in digital forensics to retrieve data from memory chips or storage devices when traditional methods prove ineffective. It is particularly valuable in cases where a device is damaged, password-protected, or otherwise inaccessible through conventional means.  

If an Integrated Circuit (IC) has been subjected to some form of physical damage, by heat, fire, or other form damage, like broken pins for example, it still can be possible to recover data from the device. 

Integrated Circuits can fail due to the bond wires becoming damaged, open circuit. These damaged IC’s may be memory devices that contain crucial data, or you may require access to silicon layer for testing.   

Data may be contained on devices such as the non-volatile memory in mobile phones and, more commonly now, on Solid State hard Drives (SSD’s) found in laptops and computers. 

Using a cocktail of chemicals, the IC packaging can be removed giving access to the silicon inside the IC package. This is known as de-caping. This will give access to wire bonds and pads. The pads on the IC are how the bond wires connect to the silicon. 

If the wire bonds are damaged the IC can either be probed on to the pads of the IC.  Or the silicon re-boned into a new IC holder that can then be read electronically or placed back into a device to make a working system.   

Most silicon devices have special protection, glass layers, over them that may also need removing. This can be done by plasma etching. Digital Safety CIC, in collaboration with the University of East London. Have built facilities to do this alongside de-caping, probing and rebounding. 

Our laboratory continues to research new cocktails of chemicals and other techniques that allow data to be recovered from damaged IC’s, systems, and devices. 

While chip-off forensics is a powerful tool in the realm of digital investigations, it needs to be handled by trained experts. The process involves physical alteration of the original device, and unauthorized attempts could lead to data loss or damage. Therefore, chip-off forensics should only be performed by trained professionals adhering to legal and ethical guidelines. 

As technology continues to advance, so too do the challenges of digital forensics. Our training in chip-off forensics remains an indispensable technique in the ever-expanding toolkit of digital forensic experts. Chip-off forensics stands as a testament to the innovative methods developed to overcome these challenges, providing a valuable tool for extracting critical data from electronic devices in a wide range of forensic investigations.  

For more information on our training click here