Data is retained in SIM card devices that are subjected to temperatures which exceed those likely to be experienced in house fires. In some cases the data is retrievable by rebuilding severed connections; however, in the majority of instances, chips will suffer additional damage to the top surface or circuitry, or experience some mechanical damage. In these cases, although the data is retained in the memory, it cannot be read by conventional methods, and an alternative technique, such as direct probing of the stored charge, needs to be employed to access the retained data

Jones, BJ

English

Brunel University Research Archive

Burnt to memoryMobile phones are essential tools for work andleisure in modern society. This ubiquity ofuse in the general public can be an asset incrime scene investigations, as many criminals and victimsof crime will be carrying mobile phones, each with aunique Subscriber Identity Module (SIM) card. Manyphones turn up at crime scenes and accident sites.Whether a phone is found with a body, or has been usedto detonate a bomb, forensic analysis may be able to helpidentify victims or perpetrators, last active location, orcalls made and received – which could provide vital assis-tance to investigators of these incidents.Unfortunately, in some cases such as road traffic accidents,bomb sites and building fires, mobile phones may be significantly damaged, either mechanically or by hightemperatures. In many cases data from damaged phonescan not be read in the usual manner; however, the actualdata may be retained in even highly damaged phones, butis inaccessible by conventional techniques.EPSRC funded researchers at ETCbrunel and UCLElectronic Engineering, in association with The ForensicScience Service, have been working to determine thelevel of retained data within a heat damaged SIM card orsmar t card , and todevelop novel dataextraction methods toglean information fromburnt or damaged SIMcards for use in forensicinvestigations.In this respect, the mostvaluable part of a SIMcard is the non-volatilere-writable memory, usually in the form of flash mem-ory. This is part of the chip that is integrated into thefamiliar SIM card package and allows easy reading of thedata via electrical contact to the interface. In someinstances where the SIM card package has been damaged,electrical contacts can be made on the surface of the chipitself. However, this practice is becoming more difficultfor a number of reasons, including the need for specifichardware access control circuits for each different type ofchip, and, in particular, because of the high likelihood ofthe chip being damaged during criminal activities, by fire,or during extraction.In a typical memory device, data are held in individual bitcells, in the form of charge storedon a floating gate, electrically iso-lated top and bottom by a very thinoxide layer. Each memory bit(making up 1/8th of a byte) is eithera 0 or 1 and consists of the presenceor absence of charge that is intro-duced or removed from thefloating gate by applying a voltageto various control points – writingor erasing the data. Once in thefloating gate, charge is held theredue to the surrounding oxide.Modern flash memories are capableof holding charge for severaldecades. Each bit cell is less than athousandth of a millimetre in size,Dr Benjamin Jones, Research Co-ordinator at the Experimental Techniques Centre,Brunel University, turns the spotlight on to data extraction from damaged mobile phones…FORENSIC SCIENCE68SIM card recovered from fireand thousands of these are connected via multiple layersof micro-circuitry to the microprocessor unit, interfaceand the outside world.Damage by heat or fracture may have broken some ofthese connections, or damaged the upper circuitry, thuscausing a SIM card to become unreadable via the inter-face or through direct probing of electrical contacts.However, the stored data – charge retained in the floatinggate – will not necessarily have been compromised; onlythe conventional access route is removed. Samples of SIM cards represent-ing a range of manufacturers,n e t w o r k s a n d a g e s w e r e  collected from networks, distrib-utors and members of the publicin Ireland, Sweden and the UK.Researchers processed the SIMcards and created a deliberatelyartificial experimental arrange-ment, an idealised situationwhere mechanical damage to thechip is minimised.SIM card chips were heated inidealised conditions to a range oftemperatures up to 650oC, thenreassembled and connected toan interface for reading via con-ventional means. At the highesttemperatures, the heatingcaused damage that renderedreading by reconnection impos-sible. However, all mechanicallyundamaged chips heated totemperatures of around 180oCcould be read with this method,and uncorrupted data was alsoobtained from a device heated toapproximately 450oC.These experimental results aresupported by data published by manufacturers. Mostmemory device manufacturers provide nominal data reten-tion times for operation at room temperature. In somecases, this can be extrapolated to operation times at differenttemperatures, using a variety of models. Information forone memory type suggests data can be retained at 450oC forapproximately an hour, while at 700oC this has reduced to afew minutes.The relevance of these temperatures can be seen fromexperiments conducted by researchers in the NationalInstitute of Standards and Technology in America. In theirexperiment on a full-scale house fire, fuelled by householdfurniture and accelerated with petrol and oil, the tempera-ture experienced varies with location within the house, andincreases significantly with height. Although the maximumtemperature reached was 738oC, this is only obtainedbriefly, close to the ceiling. The maximum temperature inthe floor area is 166oC and temperatures here are in factonly maintained above 100oC for 90 seconds, indicatingthat phones in these locations will not suffer data loss dueto heating effects. At approximately desk height, the tem-perature is sustained at an average of 450oC; data retentionwill only become an issue for phones that experience thistemperature for an hour or longer. FORENSIC SCIENCE69Magnified optical image of moderate heat-induced damage to surface of SIM card chipSections salvaged from SIM card suffering minor heat damage,including, far left, the microchip; with undamaged SIM card for comparisonIt is worth noting that these temperatures are maximumsand the house fire temperature is considerably reducedaway from the source of ignition and highly combustiblefurnishings. The temperatures reached in an adjacentroom comfortably allow sustained data retention.From these experiments we can see that data are likely tobe retained in phones that experience temperatures similarto those of a house fire. However, for many SIM cardsheated outside idealised laboratory conditions, access tothe data through conventional electrical contacts is impos-sible due to the additional damage caused to the chip.A key question is the feasibility of reading this data fromchips that have been exposed to elevated temperatures orhave suffered mechanical damage. A range of techniquesexists to access protected data or programs in embeddedmicroprocessors during program execution – what mightcommonly be called hacking. Such techniques can benon-invasive: side channel attacks monitor unintendedoutcomes of processor operation. For example, it is possi-ble to measure charge movement within processors usingmagnetic probes. Highly invasive techniques can also beused, such as deliberately introducing a fault in the chipand observing the response. Fraud countermeasures,advanced cryptography and physical protection systemsare put in place by manufacturers to curtail theeffectiveness of such attacks.Many of these techniques are unsuitable forreading memory from burnt phones as theyrequire either an operating chip, knowledge ofthe specific electronic architecture, or theymay result in degradation or erasure of thestored memory.An alternative is to use a highly controllable,ultra-fine, electrically sensitive probe todirectly read the charge in individual floatinggates, each corresponding to one bit. This hasthe advantages of not requiring the upper cir-cuitry to remain intact, and is operable even ifonly fragments of the chip are available. Thismay, therefore, be a useful technique to detectthe data that is retained even in damaged chips.However, there are considerable drawbacks insuch techniques, including the very slow readspeed, the delicate and lengthy preparationprocess which may destroy cells or compro-mise the integrity of any data retained – and,lastly, the descrambling of the binary contentsof the memory array into meaningful data. In summary, data is retained in SIM carddevices that are subjected to temperatureswhich exceed those likely to be experienced inhouse fires. In some cases the data is retrievableby rebuilding severed connections; however, inthe majority of instances, chips will suffer additional dam-age to the top surface or circuitry, or experience somemechanical damage. In these cases, although the data isretained in the memory, it cannot be read by conventionalmethods, and an alternative technique, such as directprobing of the stored charge, needs to be employed toaccess the retained data. Investigations into the develop-ment of data reading techniques are continuing, as part ofETCbrunel’s broader interest in forensics, which extendsinto fingerprinting, ballistics and failure analysis.FORENSIC SCIENCE70Dr Benjamin JonesResearch Co-ordinatorExperimental Techniques CentreBrunel UniversityUxbridgeMiddlesex UB8 3PHb.j.jones@physics.orgwww.ETCbrunel.co.uk

Burnt to memory: Data extraction from heat damaged mobile phones

Abstract

Similar works

Full text

Available Versions

Brunel University Research Archive