Chip-off forensics enables law enforcement and forensic laboratories to recover and interpret data on flash memory devices such as mobile phones and hard drives (Ref. 1). After unsuccessful attempts of data extraction from other conventional methods, forensic experts can use the chip-off technique as a last resort data recovery procedure (Ref. 2). Chip-off forensics involves de-soldering a chip off a printed circuit board (PCB), cleaning the chip, and using an adapter to connect the chip to a specialty software program for analysis (Ref. 1). However, chip-off forensics can be risky possibly damaging the chip or the device (Ref. 2). Also after detachment, the chip cannot be reattached to the device preventing the investigators from using other data recovery efforts (Ref. 2). But, chip-off forensics has helped many investigators extract the raw data off devices previously unusable as evidence. Chip-off can be helpful for data recovery in the following circumstances (Ref. 1):
Damaged phones – severely damaged phones that have been smashed, broken in half, water damaged, and other unrepairable conditions.
Password protected phones – unencrypted phones protected with a passcode, pattern, or another type of lock.
Devices lacking a data port – such as digital recorders with no data port or with an unsupported data port.
Deleted content – such as phone calls, photos, and text messages.
Chip-off Forensics Steps
Chip-off forensics entails three main phases to the data recovery process: assessment, acquisition, and analysis (Ref. 1).
The assessment phase of chip-off forensics requires forensic experts to research the device to determine the feasibility of using chip-off forensics (Ref. 1). They must check for other usable data recovery methods and device encryption (Ref. 2). The device or chip may become damaged during the chip-off procedure. Thus, other methods should be explored and tested before proceeding with chip-off (Ref. 2). Also, newer cell phones use encryption to store data. Soon, supercomputers will be able to analyze encrypted raw data (Ref. 3). However, for now, forensic labs do not have this capability and should not use chip-off forensics for encrypted devices (Ref. 3). Similarly, professionals should identify key components of the device to accurately locate the chip before taking apart the device (Ref. 1).
During the acquisition phase of chip-off forensics, skilled professionals carefully remove the chip from the device. This lengthy process requires patience, knowledge, and precision to ensure a successful extraction. For most devices, the steps for chip-off forensics are as follows:
|1. Prepare the PCB – Professionals meticulously remove the printed circuit board from the device and detach easily removable components such as the camera and displays. Stickers and metal films covering the chip should also be removed (Ref. 4).|
|2. Use hot air to remove the chip from the PCB – Depending on the type of chip packaging, experts use different procedures to remove the chip from the PCB (Ref. 1). For older TSOP (thin small outline package) chips, a hot air station can be used to loosen up the solders to remove the chip from the PCB. For newer BGA (ball grid array) chips, manufacturers use an underfill or adhesive to attach the chip to the PCB for an increase in rigidity and to help with heat transfer (Ref. 4). Coupled with the underfill, BGA chips have 40 to 225 solder connections under the chip which must be carefully heated for safe removal (Ref. 1). The PCB should be preheated to 400°C to help loosen the chip. Then, the operator applies a rosin-based flux around the chip and uses hot air to melt the underfill and the solders (Ref. 4). Once melted, the chip can be carefully lifted with a blade for removal from the PCB (Ref. 4).|
|3. Clean the chip – To clean the chip, the expert applies more rosin-based flux and uses a flat tip soldering iron to scrape off epoxy residue (Ref. 4). Alternatively, a rosin-based de-soldering braid can be used with a soldering iron to aid in cleaning the chip (Ref. 1). After removing most of the residue, a solvent, such as alcohol or a more harmful substance, cleans the surface to prepare the chip for data retrieval (Ref. 1).|
|4. Reball the chip – For BGA chips, the soldering connectors on the underside have to be repaired by “reballing” solder onto the existing connectors (Ref. 2). Flux can be used to temporarily stick the balls to the connectors and then melted with a solder to permanently attach them to the chip. Now, the chip is ready for data to be extracted for analysis (Ref. 1).|
For analysis, the forensic expert places the clean chip into a specialized socket reader for the specific device and chip type. The reader connects to the computer and specialized analysis software interprets the raw data displaying the device’s photos, contacts, messages, and other information (Ref. 1)
Chip-off Forensics Health Hazards
Chip-off forensics uses high heat and solvents that release harmful fumes into the air causing respiratory health hazards to the operator and nearby employees. Metal fumes emit from the chip when melting the solders with hot air for chip removal and when reballing or resoldering the connectors. Similarly, the chip removal and the cleaning procedure give off rosin fumes when heating a flux. Likewise, the hot air treatment melts the underfill or adhesive on the chip producing epoxy fumes. Depending on the solvent used for cleaning, the final cleaning step may generate harmful solvent fumes. Each of these fumes can produce health effects to the operator and exposure must be minimized to protect employee respiratory safety.
Solder or Metal Fumes
Modern electronic manufacturers use lead-free solder commonly containing tin, copper, silver, and bismuth (Ref. 5). In older devices, the solder may contain lead. The specific content of the solder directly affects the severity of potential health effects. The chart below summarizes the most commonly used metal for solders in electronics including the permissible exposure limit (PEL) mandated by OSHA and the possible health effects associated with each type of metal.
Common Metals in Electronic Solder
Legal Exposure Limits and Possible Health Effects
|Metal||OSHA PEL (Ref. 6)||Health Effects|
|Kidney disease, hypertension, weight loss (Ref. 7)|
|Tin||2 mg/m3||Eye, skin, respiratory irritation (Ref. 8)|
|Copper||0.1 mg/m3||High doses can result in metal fume fever – flu-like symptoms with chills, muscle aches, and nausea (Ref. 9)|
|Throat irritation, blue-gray eyes, nasal septum, gastrointestinal disturbance (Ref. 10)|
|Bismuth||None||Kidney damage, respiratory irritation (Ref. 11)|
Flux – Rosin Particulate & Fumes
Rosin-based flux, derived from pine trees, when heated produces a fume called colophony (Ref. 12). Colophony contains a complex mix of gases and particulate. The majority of colophony smoke contains particulates that can damage the lungs leading to the development of occupational asthma (Ref. 13). This impairment particularly harms people with preexisting respiratory conditions such as asthma, bronchitis, and emphysema (Ref. 12). In general, inhalation of colophony leads to eye, throat, and lung irritation (Ref. 13).
Exposure to epoxy fumes can cause irritation or inflammation of the nose, throat, and lungs. Allergic sensitization can develop making an individual have an allergic reaction from exposure to a small concentration of epoxy. Similar to colophony, epoxy fumes inhalation can lead to the development of occupational asthma.
Depending on the solvent used for cleaning the chip, inhalation of solvent fumes can lead to headaches, dizziness, nausea, vomiting, drowsiness, sore throat, and trouble breathing. Long-term exposure can result in the throat, lungs, liver, kidney and central nervous system damage. Employers should review the MSDS of the solvent used to understand the potential health hazards.
Chip-Off Forensics Safety Solutions
Implementing chip-off forensics safety solutions can provide employers with numerous benefits including increased productivity, gaining a competitive edge, preventing absenteeism from illnesses, and possibly reducing worker’s compensation cases and injury litigations. Overall improving the worker’s health and safety, in turn, increases worker morale and builds trust between the employer and the employee.
Sentry Air Systems offers a wide variety of respiratory engineering controls suited for chip-off forensics workspaces. The most popular solutions for chip-off forensics include ductless fume hoods, wall-mounted fume extractors, and portable fume extractors.
Our fume hoods and fume extractors use a powerful fan to draw in fumes and particulate into the filtration chamber away from the operator’s breathing zone. The system creates a recirculating air pattern by removing most of the fumes and particulate from the air and releasing it back into the room. Through the use of filtration rather than ductwork, ductless systems remove the requirement for external ductwork and makeup air production. Ductless systems can save facilities money by eliminating expensive building modifications and the need to temperature control makeup air.
All of our systems offer benefits including low maintenance, long filter life for particulate filters, and energy efficiency. High efficiency filters available include HEPA (up to 99.97% efficiency on particles as small as 0.3 microns), ULPA (up to 99.995% efficiency on particles as small as 0.12 microns), ASHRAE (up to 95% efficiency on particles as small as 0.5 microns) for particulate removal and activated carbon and specialty blended filter media (aldehyde, ammonia, acid gas, mercury, etc.) for chemical fume containment. Our systems offer dual filtration options to capture both fumes and particulate. If the facility uses hazardous solvents often, we recommend using HEPA filters in combination with activated carbon filters to properly control both solvent fumes and particulate.
Ductless Fume Hoods
Model 200 Wall Mounted Fume Extractor
Model 300 Portable Fume Extractor
Protect employees from fumes and particulate emitted during chip-off forensics in your laboratory.
Call us today at 1-800-799-4609
1. Swauger, Jim. “Chip-Off Forensics.” Digital Forensics, Feb. 2012, pp. 52-55. Accessed from: http://www.binaryintel.com/wp-content/uploads/2012/05/Chip-Off_Forensics_Article.pdf.
2. Elder, Bob. “Chip-off and JTAG Analysis.” Evidence Magazine, June 2012, pp. 10 -15. Accessed from: http://www.evidencemagazine.com/index.php?option=com_content&task=view&id=922I.
3. “Recovering Data from a Physically Damaged iPhone with Chip-off Forensics.” Apple Gazette, 23 July 2018. https://www.applegazette.com/iphone/recovering-data-from-a-physically-damaged-iphone-with-chip-off-forensics/.
4. “How to Save Lost Data from a Dead Phone using Chip-off Data Recovery.” Flash Fixers, 10 Sep 2018. https://flashfixers.com/recover-data-dead-phone-chip-off-data-recovery/.
5. Das, Santosh. “Lead-Free Solder and Composition| Pb-Free Solder.” Electronics and You, 4 Aug 2019. http://www.electronicsandyou.com/blog/lead-free-pb-free-solder-and-composition.html#Why_Lead_Free_in_Electronics.
6. “OSHA Annotated Table Z-1.” Occupational Safety and Health Administration. https://www.osha.gov/dsg/annotated-pels/tablez-1.html.
7. “Lead.” NIOSH Pocket Guide to Chemical Hazards, 29 Nov 2018. https://www.cdc.gov/niosh/npg/npgd0368.html.
8. “Tin.” NIOSH Pocket Guide to Chemical Hazards, 29 Nov 2018. https://www.cdc.gov/niosh/npg/npgd0613.html.
9. “Copper.” NIOSH Pocket Guide to Chemical Hazards, 29 Nov 2018. https://www.cdc.gov/niosh/npg/npgd0150.html.
10. “Silver.” NIOSH Pocket Guide to Chemical Hazards, 29 Nov 2018. https://www.cdc.gov/niosh/npg/npgd0557.html.
11. “Bismuth – Bi.” Lenntech, 2019. https://www.lenntech.com/periodic/elements/bi.htm.
12. “The Health Risks of Solder Flux Fumes.” Metcal Blog, 21 Aug 2017. http://blog.okinternational.com/metcal/the-health-risks-of-solder-flux-fumes.
13. “Soldering Safety.” University of Cambridge, 2019. https://safety.eng.cam.ac.uk/safe-working/copy_of_soldering-safety.