Chip-off acquisition
Definition
A physical extraction method in which the flash memory chip is desoldered from the device's circuit board and read directly with specialised hardware. Used when the device has no standard data interface and firmware-level access is blocked. Destructive to the device but preserves a raw image of the storage media.
Related terms
- Bootloader
- Firmware that runs immediately after power-on to verify, load, and hand control to the operating system. A locked bootloader refuses to execute...
- Cloud backend
- The vendor-operated server infrastructure where IoT device data is stored, processed, and made accessible via companion apps. The cloud backend is often...
- Companion app
- The smartphone application that pairs with an IoT or wearable device, caches recent sensor data locally, and relays data to the cloud...
- EDL mode (Emergency Download mode)
- A Qualcomm diagnostic protocol embedded in the Primary Boot Loader (PBL) that activates before the main OS and accepts raw memory read...
- eMMC (embedded MultiMediaCard)
- A flash storage standard that packages NAND memory chips and a controller into one soldered module using a parallel interface. Common in...
- Faraday enclosure
- A shielded container or bag that blocks all radio-frequency signals including Wi-Fi, Bluetooth, cellular, and Z-Wave. Used at scene to prevent remote...
- File-based encryption (FBE)
- An Android encryption model introduced in Android 7.0 in which each file is encrypted with a separate key derived from the user...
- Full-disk encryption (FDE)
- A storage protection model in which the entire partition is encrypted with a key derived from the user's passcode and hardware-bound identifiers....
- IoT (Internet of Things)
- The category of networked physical objects embedded with sensors, processors, and communication modules that collect and transmit data without continuous human interaction....
- ISP (In-System Programming)
- A variant of direct chip access that connects to the eMMC command and data pins while the chip is still on the...
- JTAG (Joint Test Action Group)
- The industry group that produced IEEE standard 1149.1, which defines the test access port and boundary-scan architecture built into most modern integrated...
- NAND flash
- The type of non-volatile memory used in all modern mobile device storage. Data is written to pages grouped into blocks; erasure operates...
Explained in these topics
- IoT and Wearable Device ForensicsA physical extraction method in which the flash memory chip is desoldered from the device's circuit board and read directly with specialised hardware. Used whe...
- JTAG and Chip-Off AcquisitionA forensic technique in which the storage chip (eMMC or NAND flash) is physically removed from the device's circuit board using heat or chemicals and then read...
- Physical Acquisition TechniquesA technique in which the storage chip is physically desoldered from the device's circuit board, mounted in a chip reader, and dumped independently of the devic...