Varying Instructional Approaches to Physical Extraction of Mobile Device Memory

Digital forensics is a multidisciplinary field encompassing both computer science and criminal justice. This action research compared demonstrated skill levels of university students enrolled in a semester course in small device forensics with 54 hours of instruction in mobile forensics with an emphasis on physical techniques such as JTAG and Chip-Off extraction against the skill levels of industry professionals who have completed an accelerated 40 hour advanced mobile forensics training covering much of the same material to include JTAG and Chip-Off extraction. Participant backgrounds were also examined to determine if those participants with a background in computer science had an advantage over participants with a criminal justice background. Study participants were volunteers ranging in age from 20 to over 60 and had a variety of backgrounds and prior work experience. Volunteers completed a timed trial comprised of four timed subtasks. Results were compared for both quality and speed in task. Qualitative, quantitative and observational data were gathered throughout the course of this study. Data gathered by this research study indicated that while students in the campus cohort were able to complete the subject trial within a 10% variance of those in the workshop cohort, the quality of the tasks completed was not within the 10% variance

Teaching Data Carving Using The Real World Problem of Text Message Extraction From Unstructured Mobile Device Data Dumps

Data carving is a technique used in data recovery to isolate and extract files based on file content without any file system guidance. It is an important part of data recovery and digital forensics, but it is also useful in teaching computer science students about file structure and binary encoding of information especially within a digital forensics program. This work demonstrates how the authors teach data carving using a real world problem they encounter in digital forensics evidence processing involving the extracting of text messages from unstructured small device binary extractions. The authors have used this problem for instruction in digital forensics courses and in other computer science courses

Chip-off Success Rate Analysis Comparing Temperature and Chip Type

Throughout the digital forensic community, chip-off analysis provides examiners with a technique to obtain a physical acquisition from locked or damaged digital device. Thermal based chip-analysis relies upon the application of heat to remove the flash memory chip from the circuit board. Occasionally, a flash memory chip fails to successfully read despite following similar protocols as other flash memory chips. Previous research found the application of high temperatures increased the number of bit errors present in the flash memory chip. The purpose of this study is to analyze data collected from chip-off analyses to determine if a statistical difference exists between the removal temperatures of flash memory chips successfully and unsuccessfully read by using a t-test, F-test and an analysis of variance (ANOVA). The results from the statistical evaluation showed no statistical difference between the groups of memory chips successfully and unsuccessfully read, as well as, between older and newer types of Ball Grid Array (BGA) memory chips