TEEL In-System Programming (ISP) For Mobile Device Forensics

In-System Programming applied to the forensic process enables examiners to access eMMC memory directly, while bypassing the controller, but not removing the chip. Utilizing the ISP process allows examiners to acquire a complete image of the chip without chip removal, and therefore provides the original evidence device to remain intact. ISP offers examiners the opportunity to acquire a complete image of the memory in a non-destructive way.

The process is used for devices using eMMC memory, the predominant chip in most of today’s smartphones.

In this four-day class, students will gain a comprehensive understanding and the skills to perform ISP extractions from devices with eMMC memory. students will be provided with three sets of phones to perform chip-off extractions to understand tracing and connection points, and then perform the data extraction from the second device using the ISP process.

Students will learn the required soldering and chip-off skills to perform extractions and compare findings between devices.

In class, students will remove chips from devices, locate ISP connections points using back tracing techniques, and then apply the ISP process to an identical phone to download the eMMC flash memory.

While chip-off and soldering techniques are taught in class, students should be comfortable with both techniques, and ideally have experience in both practices.