Cellebrite In-System Programming (ISP) Forensic Training
5 days
Advanced-level course
Course Description
Cellebrite In-System Programming (CISP) training is a five (5) day advanced level course lead by Cellebrite Certified Instructors (CCIs). During the CISP course, participants will learn about In-System Programming (ISP) processes and techniques using the precision soldering, eMMC/eMCP theory, and methodologies. Attendees will become familiar with the equipment and accessories necessary to perform direct eMMC/eMCP (ISP) extractions, without the need for chip-off and the destruction of the mobile device.
Course Content
Mobile Device Technology Overview
- Proper Identification of Mobile Devices
- Overview of How Mobile Devices Communicate
- Artifacts of Interest
- Information Potentially Available from Providers
Flash Memory
- Practical implications of ISP a mobile device
- Method
- JTAG vs. ISP
- Safety Concerns
- Encryption
Electrical Theory and Power
- Mobile Device Power
- Basic Elecronics
- Powering eMMC/eMCP chip for ISP
- Using DC Power Supply
Soldering Technique
- Solder the enamed wire onto the circut board
- Purpose
- Safety
- Techniques
Reference and Research
- How to determine if ISP process is the best option.
- ISP pinouts
- Support or unsupport ISP process
Tools and Equipment
- Equipment needed to safely prepare a mobile device for ISP
- Equipment needed to safely remove the chip
- Items needed for post processing
- Basic soldering/cleaning
- Preparing the board for soldering
- Testing Connectivity
Forensic Process
- Best practice for ISP process
- Hashing
- Validation
Cell Phone Disassembly
- Sealed devices
- Battery precautions
- Parts
- Removing the motherboard
eMMC/eMCP Chip Removal
- Heat Gun Methods
- Chip Removal
- Cleaning
- Locate the ISP Pinout using multimeter
- Preparing to read
RIFF Box and Z3X Box Software
- Install RIFF Box and Z3X Box software
- Discuss various options within the software
- Add on accessories
Z3X Pro Imaging
- Using the MOORC kit
- Z3X Pro Software
- Direct-Solder onto a eMMC/eMCP chip
Introduction to Physical Analyzer
- PA Advanced Open
- PA Chaining for flash memory
- Preparing a report of results
- Practicalstart with a device which must have the chip removed to process the data.
Last modified: Tuesday, August 10, 2021, 8:07 AM