Cellebrite Chip-Off Forensics (CCOF)

Date: 01 - 05 Nov 2021 Days: Mon-Fri Hours: 9:00 AM - 5:00 PM
Course type: Instructor Led
Region: North America
Location: Vienna, VA, United States
Capacity:Open
Enroll by: 01 Nov 2021
Log in to see the options to register for this course. If you do not already have an account, create your FREE account. Creating an account does not obligate you to enroll or pay for classes.

About this course

Description
Cellebrite Chip-Off Forensics (CCOF) is a five (5) day expert level course lead by Cellebrite Certified Instructors (CCIs). During the Chip-Off course, participants will learn about the chip-off milling process, IR Heat and polishing through the board, flash memory in mobile devices (NAND/NOR, eMMC/eMCP, UFS), methodologies, and purpose as well as understand the equipment and accessories necessary for performing successful chip-off extractions. With the successful completion of the written and practical test, student will earn the CCOF Certification.

Learning objectives

Overview of the CASE Training Course

Flash Memory - In this module, we will discuss how flash memory is used and how data is stored within mobile devices.  Students will be familiar with flash memory concerns such as wear leveling and garbage collection.

  • NAND Memory
  • NOR Memory
  • eMMC Memory

Chip Off Theory - In this module we will discuss the practical implications of chipping off a mobile device.  

  • Method
  • Safety Concerns
  • Encryption

Tools and Equipment - In this module we will discuss the equipment needed to safely prepare a mobile device for chip off, equipment needed to safely remove the chip, and items needed for post processing

  • Basic soldering/cleaning
  • Preparing the board to remove moisture
  • Working environment

Phone Disassembly - In this module, we will discuss safe methods to take apart a mobile device.

  • Sealed devices
  • Battery precautions
  • Parts

NAND Chip Removal - In this module we will discuss and perform removal of NAND flash memory from a mobile device using a milling process.

  • Milling Methods
  • Chip Removal
  • Cleaning
  • Preparing to read

Dediprog Software - In this module, we will install and configure the Dediprog Chip reader used to process certain NAND and eMMC chips.

  • Install Dediprog software
  • Discuss various options within the software
  • Add on accessories
  • Use the appropriate adapter to read the chip

eMMC/eMCP Chip Removal - In this lesson, we will remove the memory chip from a modem device using eMMC or eMCP flash memory using milling or polishing.  

  • Chip removal
  • Cleaning
  • Reading using the Sireda (or other) adapter

Z3X Pro Imaging - In this module we will use a Z3X Pro and MOORC Emates Pro adapter to image the chip as an eMMC device.  We will demonstrate using the Z3X Pro to directly read damaged chip in certain circumstances.

  • Using the MOORC kit
  • Z3X Pro Software
  • Direct Solder onto an eMMC/CP chip

Sireda - In this module, we will discuss using the branded adapters to read data from the eMMC/CP flash memory and the benefits.  

  • Benefits of branded adapters
  • Considerations to using a branded adapter

Introduction to Physical Analyzer - In this module, we will use Physical Analyzer to process the extracted data from the flash memory chip.  

  • PA Advanced Open
  • PA Chaining for flash memory
  • Preparing a report of results

Lap and Polishing - In this module we will use a polisher to remove the PCB  from underneath the eMMC/eMCP chip, preventing heat from damaging the chip.

  • Equipment
  • Considerations
  • Removing the remaining board
  • Chip clean up

Practical - In this module, we will start with a device which must have the chip removed to process the data. The student can use either method learned in the course.  A report of results will be prepared at the end.

  • This practical will be required to earn the certification


Class details