A visual approach to interpreting NAND flash memory |
| |
| Affiliation: | 1. Institut de Recherche Criminelle de la Gendarmerie Nationale (IRCGN), Digital Forensics department (INL), 1 boulevard Théophile Sueur, 93110 Rosny-Sous-Bois, France;2. PRES Sorbonne Universités – Université Panthéon-Assas Paris II, 12 place de Panthéon, 75005 Paris Cedex 05, France;3. Kriminaltechnisches Institut (KTI) des Bundeskriminalamtes (BKA), Äppelallee 45, 65173 Wiesbaden, Germany;1. Faculty of Computing, Engineering and Science, University of South Wales, Treforest, CF37 1DL, UK;2. ECU Security Research Institute, Perth, Australia;3. Noroff University College, Norway;1. New Orleans, LA, United States;2. Center for Computation and Technology and Division of Computer Science and Engineering, Louisiana State University, Baton Rouge, LA, United States |
| |
| Abstract: | The research described in this paper proposes methods for visually interpreting the content of raw NAND flash memory images into higher level visual artefacts of assistance in reverse engineering and interpreting flash storage formats. A novel method of reverse engineering the structure and layout of individual memory locations within NAND flash images, based on injecting a known signal into a test NAND environment is also proposed. Omissions in the current theory of operation of flash, in particular the role of flash memory controllers in transforming the raw NAND are identified, clarifying the cause of variations seen between images taken using pseudo physical and raw physical techniques. The effectiveness of the approach is validated against raw NAND images from YAFFS2 based Android phones, taken via JTAG and chip-off methods. |
| |
| Keywords: | Digital forensics NAND flash Visualisation Reverse engineering FTL |
| 本文献已被 ScienceDirect 等数据库收录！ |
|
