NAND Flash Memory Forensic Analysis and the Growing Challenge of Bit Errors

Abstract

When standard acquisition methods fail, forensic investigators can, in order to secure data from a device, resort to advanced chip-off techniques where memory chips are detached from the device and read directly. Developments in modern memory chip technology, such as miniaturization and the introduction of advanced reliability enhancing techniques, necessarily impact the efficiency of chip-off analysis. In this article, the authors discuss challenges imposed by reliability aspects of modern NAND-flash memory chips from a digital forensic perspective, and describe how acquisition and analysis techniques can be adapted to recover accurate and relevant data from NAND-flash memory chips. Additionally, the authors describe the idea of using error information from NAND flash memory chips as a means to infer forensically relevant information about the device, such as the age of a piece of data.