Innovation in Digital Forensics

Many digital forensics labs solely rely on the tools they purchase and the specific training methodologies that they are taught. We just don’t think that way. We are constantly trying to find new ways to uncover more information in ways that most digital labs either haven’t thought of yet or don’t have the ability to try. Our years of research and development in data recovery has given us that ‘never give up’ attitude when it comes to digital investigations.

For example, we were recently assisting an agency in a homicide case and ran across a victims phone which had been broken in half.  All we had was the circuit board from this older flip phone.  In most cases on newer phones we can perform a chip-off of the memory and read it with a device programmer.  From there we then reconstruct the data on the phone for analysis.  However, in this case, the form factor of the chip was much smaller than a typical eMMC chip seen on newer phones.  Searches on the numbers on the chip itself came up empty as to what it was.  So we were stuck with a dilemma: If we pulled the chip off the phone and it ended up being a type of chip that isn’t able to be analyzed, then we just ruined the only chance for getting any evidence in the case.

So, how could we come up with a new way to find out what type of chip was on the phone without pulling the physical chip off the board?  What if we could see through it?  Aha!  That’s it!  However, although we like to think of our examiners and engineers as superheroes, Superman doesn’t work here.  That’s OK, we can use regular x-ray for that, right?

There you go.  It worked!  The chip right in the middle is the memory chip, and yep, its a regular eMMC chip.  Now we knew we can remove the chip and grab the data to solve the case.  Of course, we removed it with our heat vision.