Chipset (PCH)
Definition
The motherboard logic that bridges CPU, RAM, PCIe lanes, SATA, USB and the firmware (UEFI/BIOS). On Intel boards the Platform Controller Hub; on AMD boards the equivalent fusion controller.
- Function
- Bridges CPU, RAM, PCIe, SATA, USB, firmware
- Intel term
- Platform Controller Hub
- AMD equivalent
- Fusion controller hub
- Location
- Motherboard logic
Common questions
Why does a forensic examiner need to know the chipset in a seized computer?+
The chipset determines which storage interfaces, USB controllers, and firmware features are present, which affects what acquisition method works, whether a hardware write-blocker is compatible, and whether features like Intel ME or fast-boot states could affect data on the drive.
Does the chipset store any forensically relevant data itself?+
The chipset is mostly a routing and control component rather than a data store, but its associated firmware (UEFI/BIOS settings, boot order, secure boot state) can hold configuration data relevant to how and whether the system was tampered with before seizure.
Related terms
- BIOS / UEFI
- Firmware on a flash chip on the motherboard that runs at power-on, initialises hardware, and hands control to a bootloader. UEFI is...
- CMOS Battery
- A small lithium cell (typically CR2032) that keeps the real-time clock and a few firmware settings alive when the system is unplugged....
- NAND Flash Wear Leveling
- The SSD controller's policy of spreading writes across physical blocks so no single block wears out first. The side effect for forensics...
- Order of Volatility
- The sequence in which digital evidence should be collected, ranked from most to least transient. Defined in RFC 3227. CPU registers and...
- TRIM
- A command issued by the file system to the flash controller identifying blocks that are no longer in use, so the controller...