NAND flash
Definition
The type of non-volatile memory used in all modern mobile device storage. Data is written to pages grouped into blocks; erasure operates at the block level. NAND flash has a finite write endurance per cell, which drives the wear-leveling and garbage collection behaviors that affect forensic recovery.
Related terms
- App sandbox container
- An isolated directory assigned to each app on iOS under /var/mobile/Containers/Data/Application/<UUID>/. The container holds all of the app's Documents, Library, and tmp...
- Bootloader
- Firmware that runs immediately after power-on to verify, load, and hand control to the operating system. A locked bootloader refuses to execute...
- Chip-off acquisition
- A physical extraction method in which the flash memory chip is desoldered from the device's circuit board and read directly with specialised...
- EDL mode (Emergency Download mode)
- A Qualcomm diagnostic protocol embedded in the Primary Boot Loader (PBL) that activates before the main OS and accepts raw memory read...
- File-based encryption (FBE)
- An Android encryption model introduced in Android 7.0 in which each file is encrypted with a separate key derived from the user...
- Full-disk encryption (FDE)
- A storage protection model in which the entire partition is encrypted with a key derived from the user's passcode and hardware-bound identifiers....
- iOS Keychain
- A hardware-backed secure credential store on iOS devices that holds passwords, authentication tokens, and cryptographic keys. Keychain items are encrypted with keys...
- Plist (property list)
- A structured data format native to Apple operating systems, available in XML and binary variants. iOS uses plist files to store app...
- SQLite
- A lightweight, serverless relational database engine used pervasively on both iOS and Android to store structured app data including messages, call logs,...
- Wear-leveling
- A flash storage controller behavior that distributes write operations across all available memory cells to prevent premature failure of any single cell....
Explained in these topics
- Data Persistence and Evidence Locations on Mobile DevicesThe type of non-volatile memory used in all modern mobile device storage. Data is written to pages grouped into blocks; erasure operates at the block level. NA...
- Physical Acquisition TechniquesThe non-volatile memory technology used in virtually all mobile device storage. Data is written in pages and erased in blocks; physical acquisition reads the r...