Chip-Off and Hardware Forensics

What it is and why it matters

Most extractions go through the device's own software. When that path is closed, because the device is damaged, the operating system is dead or the model has no tool support, the examiner can go to the hardware. Three techniques are used in laboratories. JTAG uses a debug port on the circuit board to make the processor read the memory. ISP connects directly to the test points of an eMMC chip while it is still soldered in place. Chip-off removes the memory chip from the board and reads it in a programmer.

Each step down this list is more invasive. Chip-off destroys the device as a working object, so it is a last resort, taken under explicit authority and after every less destructive route has been recorded as unavailable. The reward is a complete copy of the physical memory, including areas the operating system never exposes.

Encryption changed the picture. Modern phones encrypt user data with keys bound to the processor, so a raw chip dump from a recent Android or iOS device is ciphertext. Hardware methods remain valuable for older phones, feature phones, drones, vehicle modules, IoT devices, DVRs and damaged media where the data is not encrypted or the keys are recoverable.

Types of digital evidence

Raw Memory Dump
The full contents of the eMMC, UFS or raw NAND chip, including every partition, unallocated space and areas hidden from the operating system.
File Systems Within the Dump
ext4, F2FS, FAT or proprietary file systems that are parsed after the dump is reassembled, giving the same artefacts a file system extraction would.
Deleted Data in Unallocated Pages
Pages the file system has released but the flash controller has not yet erased, recoverable where encryption does not apply.
Bootloader and Firmware
The device's boot chain and firmware, which show the OS version, modifications and sometimes the state of security settings.
Device-Specific Data
Flight logs on a drone, event records in a vehicle module, recordings on a DVR board or sensor data on an IoT device that have no other way out.
Spare Area and Controller Metadata
On raw NAND, the extra bytes per page that hold error correction codes and mapping data needed to rebuild the logical image.

Devices and data sources

Feature phones and older Android handsets without file-based encryption
Physically damaged smartphones where the board is intact but the screen, port or power circuit is dead
Drones, dash cameras and action cameras with soldered eMMC storage
Vehicle infotainment and telematics modules
DVR and NVR boards from surveillance systems
IoT devices, smart home hubs and industrial controllers
USB pen drives and memory cards with a failed controller, where the monolith or NAND is read directly
Embedded devices in point-of-sale terminals and ATMs examined under authority

How an examination runs

The order matters. Each step protects the one after it.

01
Justify and Authorise
Record why software methods failed or do not exist, obtain written authority for a destructive method and confirm with the case owner that the device will not work afterwards.
02
Research the Board
Identify the processor, memory chip part number, package type and whether the data is likely to be encrypted. Find the service documentation or test point maps for ISP or JTAG.
03
Photograph and Document
Photograph the board before any work at a resolution that shows every component and marking. Record the chip location and orientation.
04
Least Destructive First
Attempt JTAG or ISP where the board supports it, since both leave the chip in place. Move to chip-off only if those fail or are not possible.
05
Remove and Read
For chip-off, remove the chip with controlled heat and lift, clean and reball if needed and read it in a programmer with the right adapter. Read twice and compare the hashes to confirm a stable read.
06
Reassemble the Image
For raw NAND, apply error correction, remove scrambling or XOR patterns and rebuild the logical order from the controller's mapping. eMMC and UFS present a block device and need less rebuilding.
07
Parse and Report
Parse the partitions and file systems with standard tools, verify key artefacts manually and report the method, the risks taken and what the encryption state allowed.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

JTAG: Joint Test Action Group, a standard debug interface on many circuit boards. In forensics it is used to drive the processor to read memory through the test access port.
ISP: In-System Programming, connecting to the data and clock lines of an eMMC chip on the board so it can be read without removing it.
Chip-Off: Physically removing the memory chip from the board and reading it in a dedicated programmer.
eMMC: Embedded MultiMediaCard, a flash chip with a built-in controller that presents a simple block device. The most common storage in older phones and many embedded devices.
UFS: Universal Flash Storage, the faster serial-interface flash used in recent smartphones. It needs readers built for its interface and is harder to read than eMMC.
Raw NAND: Flash memory without a built-in controller. Reading it gives pages with spare areas that must be error-corrected, descrambled and reordered before any file system is visible.
Wear Levelling: The controller's practice of spreading writes across all blocks to extend chip life, which is why a raw dump does not follow logical order.
Reballing: Replacing the solder balls on a BGA chip after removal so it can sit correctly in a reader socket.
Hardware-Bound Key: An encryption key stored or derived inside the processor's secure hardware. Data encrypted with it cannot be decrypted from a chip dump alone.

Challenges and limits

What makes it hard

Encryption bound to the processor makes chip dumps from modern phones unreadable without the keys, so the method is often of no use on recent devices
Heat and handling can destroy the chip, and there is no second attempt once it fails
Raw NAND reassembly needs the right error correction, scrambling and mapping algorithms, which vary by controller and are often undocumented
UFS chips need specialised readers and adapters that not every lab has
The device is destroyed as a working object, which has legal and practical consequences for the owner
Test point maps for ISP and JTAG are not published for most devices and must be researched or found by probing
The time and skill involved make the method expensive, so it must be justified against the case value

Keeping the evidence intact

Obtain and file written authority for a destructive method before starting
Photograph the board and chip before, during and after removal
Read the chip at least twice and compare hashes to confirm a stable, complete read before any analysis
Keep the removed chip, the board and all dumps in custody and label them to each other
Document the programmer, adapter, firmware and software versions and every setting used in reassembly

Standards and legal considerations

SWGDE Best Practices
SWGDE has published best practice documents on chip-off and on JTAG and ISP acquisition that set out training, documentation and validation expectations.
Read the guide
NIST SP 800-101 Rev. 1
Places hardware-level methods at the top of the extraction hierarchy and explains when they are considered.
Read the guide
ISO/IEC 27037:2012
The preservation principles that still apply when a destructive method is the only option: justify, document, minimise and record.
Read the guide
ISO/IEC 17025:2017
The laboratory competence standard. Labs that offer hardware methods usually validate them under a quality system built on this standard.

In practice

Drone After a Crash
A drone is recovered from a field with its body broken. The flight controller board is intact. The examiner identifies the eMMC chip, reads it by ISP through its test points and parses the flight logs, which show the launch point and the path flown.
Feature Phone With a Dead Port
An old handset used in a fraud has a broken charging port and will not power on. Chip-off of the eMMC gives a full dump. The file system is unencrypted and yields the contact list, SMS and call records.
A Recent Phone Where Chip-Off Would Not Help
A damaged flagship phone from last year is assessed for chip-off. The examiner records that its user data is protected by file-based encryption with hardware-bound keys, so a dump would be ciphertext, and recommends board-level repair to attempt a software extraction instead.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

MobileMobile & IoT ForensicsAndroid ForensicsExtract and examine Android phones, from ADB pulls to WhatsApp databases and ALEAPP reportsIntermediateDCMFE

MobileMobile & IoT ForensicsIoT Device ForensicsEvidence from smart speakers, cameras, wearables and routers, plus firmware extraction basicsAdvancedIoT / Drone

MobileMobile & IoT ForensicsDrone ForensicsRecover DJI flight logs, GPS tracks and home points from drones, controllers and phone appsIntermediateIoT / Drone

MobileMobile & IoT ForensicsSIM / Memory Card ForensicsICCID, IMSI and SMS from SIM cards, plus FAT and exFAT recovery from SD and microSD cardsBeginnerDCMFE

Standards for this area

Careers that use it

Questions people ask

Does chip-off work on any phone?

It can read the chip from most phones, but reading is not the same as understanding. On recent Android and iOS devices the user data is encrypted with keys held in the processor, so the dump cannot be decrypted. It is most useful on older phones, feature phones and embedded devices.

Is the device usable afterwards?

After chip-off, no. The chip has been removed and the board heated. JTAG and ISP usually leave the device working, which is one reason they are tried first.

How is a chip dump verified?

The chip is read twice and the two dumps are hashed and compared. A match shows a stable read. Any difference means a connection or chip problem that must be resolved before analysis.

Why is hardware forensics described only in a lawful setting?

Because the same techniques could be misused to defeat security on devices that do not belong to the person doing it. DFRTI teaches them as laboratory methods under written authority, with documentation and validation, and nothing else.