Cellebrite Learning Center

Level - Advanced

Course Length: 5-Day

 

The Cellebrite’s Advanced In-System Programming Extraction (CAIE) training is an advanced level five-day course lead by Cellebrite Certified Instructors (CCIs). During this course, participants will learn about the In-System Programming (ISP) process using the precision soldering techniques, eMMC/eMCP theory, methodologies, and purpose as well as understand the equipment and accessories necessary for performing direct eMMC/eMCP (ISP) extractions without the need for chip-off and destroying the mobile device. 

Instructors will help attendees to not only develop, but also to learn the fundamental soldering skills, gain practical knowledge with hands-on practice as well as share best practices and legal considerations for processing ISP extractions. Additionally, participants will learn how to fully leverage the Physical Analyzer in order to properly decode the extractions. Students will become familiar with conducting eMMC extractions directly from a damaged board using the RIFF box and the Z3X Pro box.

The Cellebrite’s Advanced In-System Programming Extraction course is comprised of the following modules and lessons:

Introduction

Mobile Device Technology Overview

• Proper Identification of Mobile Devices
  
• Overview of How Mobile Devices Communicate
  
• Artifacts of Interest
  
• Information Potentially Available from Providers
  

Flash Memory - In this module, we will discuss how flash memory is used and how data is stored on mobile devices. Students will be familiar with flash memory concerns such as wear leveling and garbage collection. 

• NAND Memory 
• NOR Memory 
• eMMC/eMMC Memory 

ISP Theory - In this module, we will discuss the practical implications of ISP a mobile device. 

• Method 
• JTAG vs. ISP 
• Safety Concerns 
• Encryption 

Electrical Theory and Power – In this module, we will discuss the supply DC voltage for eMMC/eMCP flash chip. 

• Mobile Device Power 
• Basic Electronics 
• Powering eMMC/eMCP chip for ISP 
• Using DC Power Supply 

Soldering Technique – In this module, we will discuss how to solder the enameled wire onto the circuit board. 

• Purpose 
• Safety 
• Techniques 

Reference and Research – In this module, we will discuss how to determine if ISP process is the best option.

• ISP pinouts 
• Support or unsupport ISP process 

Tools and Equipment - In this module, we will discuss the equipment needed to safely prepare a mobile device for ISP, equipment needed to safely remove the chip, and items needed for post processing. 

• Basic soldering/cleaning 
• Preparing the board for soldering 
• Testing Connectivity 

Forensic Process – In this module, will discuss the best practice for ISP process. 

• Hashing
• Validation 

Cell Phone Disassembly - In this module, we will discuss safe methods to take apart a various cell phone models and removing the motherboard. 

• Sealed devices 
• Battery precautions 
• Parts
  

eMMC/eMCP Chip Removal - In this module, we will discuss and perform the removal of eMMC/eMCP flash memory from a mobile device using heat gun. 

• Heat Gun Methods 
• Chip Removal 
• Cleaning 
• Locate the ISP Pinout using multimeter 
• Preparing to read 

RIFF Box and Z3X Box Software - In this module, we will install and configure both RIFF Box and Z3X Box used to the data from eMMC chips. 

• Install RIFF Box and Z3X Box software 
• Discuss various options within the software 
• Add on accessories 

Z3X Pro Imaging - In this module, we will use a Z3X Pro and MOORC adapter to image the chip as an eMMC device. We will demonstrate using the Z3X Pro to be able to directly read a damaged chip in certain circumstances. 

• Using the MOORC kit 
• Z3X Pro Software 
• Direct-Solder onto a eMMC/eMCP chip 

Introduction to Physical Analyzer - In this module, we will use Physical Analyzer to process the extracted data from the flash memory chip. 

• PA Advanced Open 
• PA Chaining for flash memory 
• Preparing a report of results 
• Practical - In this module we will start with a device which must have the chip removed to process the data. The student can use either method learned in the course. A report of results will be prepared at the end. • This practical will be required to earn the certificationCellebrite Digital Forensics for Legal Professionals (CDFL)
  

Students successfully demonstrating proficiency will earn the Cellebrite’s Advanced In-System Programming Extraction (CAIE) certification. To earn this certification, the student must demonstrate proficiency in processing the data on a device which must have the chip removed and achieve a minimum score of 80% on a practical examination.  Students who opt not to demonstrate proficiency via testing will only receive a certificate of attendance.