Cellebrite Advanced Smartphone Extraction

Date: 23 - 27 Oct 2017 Days: Mon-Fri Hours: 9:00 AM - 5:00 PM
Course type: Instructor Led
Region: North America
Location: Orlando, FL, United States
Capacity:Open
Enroll by: 23 Oct 2017
Log in to see the options to register for this course. If you do not already have an account, create your FREE account. Creating an account does not obligate you to enroll or pay for classes.

About this course

Description
Cellebrite’s Advanced Smartphone Extraction (CASE) training is an advanced-level five-day course lead by Cellebrite Certified Instructors (CCIs). During this course, participants will learn about the chip-off process using a milling process, and lap/polishing through the board, NOR/NAND theory, methodologies, and purpose as well as understand the equipment and accessories necessary for performing successful chip-off extractions. Instructors will help attendees to not only develop, but also to hone fundamental soldering skills, gain practical knowledge with hands-on practice as well as share best practices and legal considerations for processing chip-off extractions. Additionally, participants will learn how to fully leverage the Physical Analyzer to properly decode the extractions. Students will become familiar with conducting eMMC/eMCP extractions directly from a damaged memory chip using the Z3X Pro box, should it be necessary.

Learning objectives

Overview of the CASE Training Course

Flash Memory - In this module, we will discuss how flash memory is used and how data is stored within mobile devices.  Students will be familiar with flash memory concerns such as wear leveling and garbage collection.

  • NAND Memory
  • NOR Memory
  • eMMC Memory

Chip Off Theory - In this module we will discuss the practical implications of chipping off a mobile device.  

  • Method
  • Safety Concerns
  • Encryption

Tools and Equipment - In this module we will discuss the equipment needed to safely prepare a mobile device for chip off, equipment needed to safely remove the chip, and items needed for post processing

  • Basic soldering/cleaning
  • Preparing the board to remove moisture
  • Working environment

Phone Disassembly - In this module, we will discuss safe methods to take apart a mobile device.

  • Sealed devices
  • Battery precautions
  • Parts

NAND Chip Removal - In this module we will discuss and perform removal of NAND flash memory from a mobile device using a milling process.

  • Milling Methods
  • Chip Removal
  • Cleaning
  • Preparing to read

Dediprog Software - In this module, we will install and configure the Dediprog Chip reader used to process certain NAND and eMMC chips.

  • Install Dediprog software
  • Discuss various options within the software
  • Add on accessories
  • Use the appropriate adapter to read the chip

eMMC/eMCP Chip Removal - In this lesson, we will remove the memory chip from a modem device using eMMC or eMCP flash memory using milling or polishing.  

  • Chip removal
  • Cleaning
  • Reading using the Sireda (or other) adapter

Z3X Pro Imaging - In this module we will use a Z3X Pro and MOORC Emates Pro adapter to image the chip as an eMMC device.  We will demonstrate using the Z3X Pro to directly read damaged chip in certain circumstances.

  • Using the MOORC kit
  • Z3X Pro Software
  • Direct Solder onto an eMMC/CP chip

Sireda - In this module, we will discuss using the branded adapters to read data from the eMMC/CP flash memory and the benefits.  

  • Benefits of branded adapters
  • Considerations to using a branded adapter

Introduction to Physical Analyzer - In this module, we will use Physical Analyzer to process the extracted data from the flash memory chip.  

  • PA Advanced Open
  • PA Chaining for flash memory
  • Preparing a report of results

Lap and Polishing - In this module we will use a polisher to remove the PCB  from underneath the eMMC/eMCP chip, preventing heat from damaging the chip.

  • Equipment
  • Considerations
  • Removing the remaining board
  • Chip clean up

Practical - In this module, we will start with a device which must have the chip removed to process the data. The student can use either method learned in the course.  A report of results will be prepared at the end.

  • This practical will be required to earn the certification

Class details

Orlando Police Department Range

100 Andes Ave

Orlando, FL 32807

Orlando International Airport (MCO)

Residence Inn by Marriott Orlando Airport

Address: 

7024 Augusta National Dr. 

Orlando, FL 32822

Phone:(407) 856-2444

Car rentals are suggested due to the fact that the hotel is 20 minutes away.