|
We aim to identify new techniques for the recovery of data directly from the electronic memory of smartcards and other embedded systems without using the onchip read interface provided for that purpose. This would allow the circumvention of any access control, such as PIN-locking, and would also allow the recovery of data from damaged chips. We aim to develop a universal method, or methods, that will allow:1. Direct reading of data from PIN-locked and/or damaged SIM cards and other smartcards;2. Direct retrieval of digital data from devices, which have been either accidentally (fire, explosion, etc.) or purposely damaged during a crime.During forensic investigations, the most valuable part of an embedded system, such as that that might be found in a smart-card or a mobile phone SIM card, is the memory, in particular the non-volatile re-writable memory. This is usually implemented as an electrically programmable read-only memory (EPROM). The ability to access this and recover data from access-locked devices, and those that have been damaged, will provide the forensic service with a new advantage in the fight against mobile crime, as well as other forms of serious crime that may be more effectively tackled with access to data that are otherwise inaccessible.We propose a one-year feasibility study, building on an existing collaboration with the Forensic Science Service, aimed at identifying a suitable technique or techniques for data recovery. We currently have a 25,000 contract with the FSS to undertake an initial literature survey, and have identified a preliminary list of possible techniques, including high resolution Scanning Probe Microscopy, Scanning Electron Microscopy, free carrier absorption measurements, induced charge measurements, and induced refractive index contrast. The aim of the proposed study is to identify the most appropriate of these through a programme of finite element device modelling, and experimentation using the state-of-the-art microscopy and semiconductor test facilities afforded by our close links with the London Centre for Nanotechnology.In addition to modelling and experimentation, the study will seek to answer a number of specific process-related questions in order to make a selection of the most appropriate measurement technique: Most techniques require removal of most of the chip metallisation and passivation. To what extent is this necessary, and how much of the passivation can be removed before the charge-retention characteristics of the target chip are seriously degraded? What spatial resolution is required? The solution should be applicable to existing and future EPROM cell sizes; however, high-resolution techniques are generally costly and slow. Are there any specific issues regarding in-built chip security that we need to be aware of? For example, capacitive sensors to detect the presence of the passivation layer.Is it possible to overcome the need to extensively modify or remove the top layers of the chip: perhaps by probing optically or electrically from the underside?Because we are currently undertaking the preliminary survey, candidate techniques is not yet known, it is difficult to propose an Accurate methodology. However, some or all of the following will be undertaken:- Modelling of the probing of EPROM cells using finite-element modelling software- Examination of optical techniques of data recovery, using modelling and experimentation - Experimental investigation into the removal of passivation layers without damaging data - Identification of the EPROM cell structure used by manufacturersClearly the proposed methodology concentrates on modelling; given the time constraints of the feasibility study, this is appropriate. The aim is that, by the end of the proposed study, we will have identified one or two approaches that may be further developed into a technique or instrument that may be used routinely in forensic investigations.
|