The most easy and non-invasive way to read flash data is by using a simple hardware interface and software that
copies all flash memory data from the target system to another system for further analysis. Unfortunately there’s no general method for this procedure because every embedded system can have its own dedicated interface to data stored in flash memory chips. There’s also no standardized “embedded system operating system” with documented low level flash memory access functions. However, memory copying tools specifically targeted towards a certain device (range) exist and can sometimes be used for forensic purposes. These tools mainly originate from two sources: manufacturers or service centers who use these tools for debugging and diagnostics and sometimes for in field software updates, and hackers who use these tools for checking and changing device functionality .
Great care should be taken when using these tools for forensic examinations. Besides memory copying functionality these tools sometimes have other options which are devastating in a forensic context. Before usage on an exhibit a flasher tool needs to be tested on a similar device from a reference collection: once thoroughly to check the functionality, and preferably before each individual examination to train the examiner in using only the forensically sound options of such a tool.
For mobile phones a lot of these tools can be found on the internet in forums like gsm-forum or online shops like gsmtechnology or gsm-server. Flasher boxes are mostly accompanied by a large number of cables to connect
different phone models.
An example of a flasher box with software which can be used with a wide variety of phones is the Twister flasher box. Figure 4 shows a screenshot of the Twister series flasher box software. With this software it is possible to make full memory copies of a large range of Nokia models. For some models only partial memory copies are possible. Figure 5 shows a screenshot of a tool for making complete flash memory copies of Samsung D500/D600 handsets. Recent versions of this tool also copy the meta data needed for reconstruction of the file system(seesectionIV-B).A lot of these flasher tools work in a similar way: they enter the bootstrap mode of a phone; upload dedicated flash loader software to RAM; execute this software and then use it for low level access to the flash memory. Further research is needed to incorporate this mechanism in future forensic mobile phone acquisition software.
Advantages and disadvantages:
* Hardware connection is usually easy with a connector.
* Flash memory can be imaged without de-soldering of flash memory chips.
* Some tools do not make a full forensic image of flash memory (some do only parts of the memory space or skip spare area).
* It can not be guaranteed that no data is written in flash memory.
Flash doctor is one of the best flash memory data recovery tools, you can learn more here about flash doctor, you can email email@example.com to get a fast price quote and coupon to purchase this tool!
Data recovery Salon welcomes your comments and share with us your ideas, suggestions and experience. Data recovery salon is dedicated in sharing the most useful data recovery information with our users and only if you are good at data recovery or related knowledge, please kindly drop us an email and we will publish your article here. We need to make data recovery Salon to be the most professional and free data recovery E-book online.