CN116842589A - FLASH chip bottom layer physical mirror image extraction method and device - Google Patents
FLASH chip bottom layer physical mirror image extraction method and device Download PDFInfo
- Publication number
- CN116842589A CN116842589A CN202310811490.2A CN202310811490A CN116842589A CN 116842589 A CN116842589 A CN 116842589A CN 202310811490 A CN202310811490 A CN 202310811490A CN 116842589 A CN116842589 A CN 116842589A
- Authority
- CN
- China
- Prior art keywords
- data
- chip
- flash chip
- image extraction
- physical
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000605 extraction Methods 0.000 title claims description 40
- 238000000034 method Methods 0.000 claims abstract description 31
- 238000013075 data extraction Methods 0.000 claims abstract description 11
- 230000006870 function Effects 0.000 claims description 66
- 238000004422 calculation algorithm Methods 0.000 claims description 27
- 238000004458 analytical method Methods 0.000 claims description 18
- 238000011084 recovery Methods 0.000 claims description 18
- 230000008569 process Effects 0.000 claims description 17
- 238000010586 diagram Methods 0.000 claims description 12
- 238000013496 data integrity verification Methods 0.000 claims description 9
- 239000012634 fragment Substances 0.000 claims description 9
- 230000015654 memory Effects 0.000 claims description 7
- 238000003825 pressing Methods 0.000 claims description 7
- 238000004364 calculation method Methods 0.000 claims description 6
- 238000007405 data analysis Methods 0.000 claims description 6
- 238000012216 screening Methods 0.000 claims description 6
- 238000004891 communication Methods 0.000 claims description 5
- 238000012545 processing Methods 0.000 claims description 5
- 238000003491 array Methods 0.000 claims description 3
- 239000000872 buffer Substances 0.000 claims description 3
- 238000006243 chemical reaction Methods 0.000 claims description 3
- 239000003086 colorant Substances 0.000 claims description 3
- 230000000295 complement effect Effects 0.000 claims description 3
- 230000006835 compression Effects 0.000 claims description 3
- 238000007906 compression Methods 0.000 claims description 3
- 125000004122 cyclic group Chemical group 0.000 claims description 3
- 238000013500 data storage Methods 0.000 claims description 3
- 238000013524 data verification Methods 0.000 claims description 3
- 239000011159 matrix material Substances 0.000 claims description 3
- 238000007781 pre-processing Methods 0.000 claims description 3
- 230000008439 repair process Effects 0.000 claims description 3
- 238000012795 verification Methods 0.000 claims description 3
- 230000007797 corrosion Effects 0.000 description 4
- 238000005260 corrosion Methods 0.000 description 4
- 238000005516 engineering process Methods 0.000 description 3
- 238000011160 research Methods 0.000 description 3
- 239000012776 electronic material Substances 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 239000000969 carrier Substances 0.000 description 1
- 239000000919 ceramic Substances 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 230000001105 regulatory effect Effects 0.000 description 1
- 238000005096 rolling process Methods 0.000 description 1
- 238000007789 sealing Methods 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
- 238000004088 simulation Methods 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- XLYOFNOQVPJJNP-UHFFFAOYSA-N water Substances O XLYOFNOQVPJJNP-UHFFFAOYSA-N 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
- G06F21/78—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
- G06F21/79—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data in semiconductor storage media, e.g. directly-addressable memories
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
- G06F21/71—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information
- G06F21/72—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure computing or processing of information in cryptographic circuits
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Software Systems (AREA)
- Mathematical Physics (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Storage Device Security (AREA)
Abstract
The invention relates to the technical field of information security, and discloses a method and a device for extracting a physical mirror image of a bottom layer of a FLASH chip, wherein the method and the device for extracting the physical mirror image of the bottom layer of the FLASH chip comprise a host, a FLASH chip adapter, a BGA chip adapter and an EMMC chip adapter are arranged at the top of the host, and an interface structure is arranged at the back of the host; the mirror image extraction software has a chip recognition function, a chip connection check function, a data reading function, and an integrity check function. The method has the advantages of being capable of being separated from the environment operation of the mobile phone, directly acquiring the image file of the memory chip, automatically checking, intelligently measuring pins, identifying and identifying capacity, automatically identifying the type of the chip, supporting complete data extraction on the conventional area, the hidden area and the encryption area of the FLASH chip, avoiding the problem that the traditional mode possibly covers deleted user data when the communication software is installed, and the like.
Description
Technical Field
The invention relates to the technical field of information security, in particular to a method and a device for extracting a physical mirror image of a bottom layer of a FLASH chip.
Background
With the development of technology and the progress of integrated circuit technology, a FLASH chip formed by a semiconductor is widely applied because of the nonvolatile memory characteristics of the FLASH chip, and meanwhile, the FLASH chip has the advantages of low cost, small volume, high speed, long service life, low power consumption and simple interface, and replaces a computer hard disk to become a storage medium of various portable digital devices. Currently, various electronic devices including smart phones, tablet computers, wearable electronic devices, U disk, smart home devices and the like are widely applied to FLASH chips as memories.
The various mobile electronic devices bring convenience to life of people, and lawbreakers use the electronic devices as tools to conduct crimes in different degrees, a large amount of data is recorded in the process, and the electronic devices serving as carriers of electronic material evidence are often destroyed or destroyed, so that the electronic material evidence cannot be started to be destroyed.
Under the condition that the electronic equipment is damaged, the FLASH chip is not damaged due to high temperature resistance, corrosion resistance and firmness, so that an application foundation is provided for extracting the physical mirror image of the bottom layer of the FLASH chip.
In recent years, research institutions at home and abroad conduct a great deal of research on electronic data extraction, but most of the research institutions are built on the basis of intact electronic equipment (such as normal data communication of a smart phone, data extraction through a logic means and the like), and are in no way when the electronic equipment cannot work normally, such as a data interface is damaged, peripheral software and hardware (such as a shell, a liquid crystal, a keyboard, software faults are not started and the like) are damaged, water inflow corrosion and the like. On the other hand, the logic extraction mode is limited in that the system authority of the electronic equipment is limited, and all data in the memory can not be acquired. Taking an Android high-version system smart phone as an example, logic extraction is operated at a software level, the smart phone is communicated with a computer, a corresponding instruction is sent by the computer, a CPU (central processing unit) of the smart phone is controlled, and then user data of the smart phone are obtained by the CPU. Although the method is simple to operate, the method has great disadvantages: under the condition that the ROOT authority cannot be acquired, the logic means is not complete in extracting data; secondly, because a control program is often required to be installed in the mobile phone in order to obtain the authority, an evidence source is polluted, thirdly, the deleted data is seriously insufficient in recovering, and the deleted file cannot be completely recovered because a complete mirror image cannot be obtained.
Disclosure of Invention
The invention provides a method and a device for extracting a physical mirror image of a bottom layer of a FLASH chip, which are used for solving the problems in the background technology.
The invention provides the following technical scheme: a FLASH chip bottom layer physical mirror image extracting device comprises
The Flash chip adapter, the BGA chip adapter and the EMMC chip adapter are arranged at the top of the host, and an interface structure is arranged at the back of the host;
the host is in charge of communication of the computer and control of the memory chip;
the Flash chip adapter, the BGA chip adapter and the EMMC chip adapter are used for connecting the host with a Flash chip of a specific type and providing a signal conversion function;
the interface structure is used for being connected with a power supply and a computer so as to control the on-off of the power supply of the host;
the mirror image extraction software has a chip identification function, a chip connection checking function, a data reading function and an integrity checking function, wherein
The chip identification function is divided into automatic identification of FLASH chip type and manual selection of FLASH chip type, and detailed parameter information is displayed;
the chip connection checking function displays the pin states of the FLASH chip in a graphical interface mode, including various states of electrifying, poor contact, useless pins, pin short circuit and empty pins, and distinguishes the states in different colors;
the data reading function automatically performs physical image extraction through a software program, and stores the extracted data in a local computer;
the integrity check function performs integrity check using the mirror extracted data and performs necessary data complement.
Preferably, the host is embedded with a two-way PWM power supply voltage control system, a pin power supply control matrix, an IO control circuit for designing pins and an Emacs chip control circuit.
Preferably, the Flash chip adapter is adapted for use with an 8-pin chip pad, a 20-pin chip pad, BGA60A, and TSOP48.
Preferably, the BGA chip adapter includes base, roller bearing, mounting groove, contact pin, apron, clamp plate and buckle, the base with electric connection between the host computer, the roller bearing rotate connect in the side of base, the mounting groove is located the top surface of base, the mounting inslot array is equipped with contact pin, the apron with the base rotates to be connected, the clamp plate is fixed in the surface of apron, just the clamp plate block connect in the inside of mounting groove, the buckle rotate connect in the side of apron, just the buckle with the roller bearing block is connected.
Preferably, the EMMC chip adapter is adapted for BGA-253, BGA-529, BGA-169E, BGA-162.
Preferably, the interface structure comprises a switch, a power interface and a USB interface, the switch is arranged on the back of the host, the power interface and the USB interface are arranged on the back of the host, the switch controls the on-off of a power supply of the host, a V voltage-stabilized power supply is supplied to the host through the connection of a V transformer and the power interface, and the host is connected with a PC through the USB interface to transmit read data to the PC.
Preferably, the BGA chip adapter is adapted for all BGA chips of the same pitch, and the mounting groove 33 is capable of mounting BGA chips of different sizes.
Preferably, the image extraction software supports multiple physical image extraction on the FLASH chip to ensure data recovery and reconstruction under the condition of chip damage or error data reading, and has the following functions in the data reading process:
(1) Error handling function: in the process of physical image extraction, if errors or reading failures occur, the image extraction software can automatically identify and record the positions and reasons of the errors and try to re-read the data so as to improve the success rate of data extraction;
(2) Region selection function: the image extraction software allows a user to select a specific storage area to perform physical image extraction, wherein the physical image extraction comprises a whole chip, a specific sector, a block or a page, so that data recovery and reconstruction can be performed in a targeted manner;
(2) Data defragmentation function: in the process of multiple physical image extraction, the image extraction software can analyze and sort the extracted data fragments so as to restore the integrity and continuity of the original data as much as possible;
(4) Data restoration function: after multiple times of physical image extraction, the image extraction software can correct and repair the extracted data so as to eliminate the influence of errors or incomplete data and restore the accuracy and the integrity of the data as much as possible;
(5) Mirror image comparison function: the image extraction software can compare the data differences and changes between different physical images to determine the consistency and integrity of the data and provide detailed comparison reports.
Preferably, the image extraction software supports the recovery of deleted data, and performs comprehensive physical image extraction and data analysis on the FLASH chip in a mode of data fragment analysis, unallocated space recovery, data reconstruction, file system analysis and data integrity verification, so that part or all of the deleted data is effectively recovered.
Preferably, the image extraction software supports compression and encryption of physical images to reduce data storage space and improve data security.
Preferably, the image extraction software further has the following functions:
(1) Data screening function: providing flexible data screening options, and allowing a user to screen and extract data in a physical mirror image according to specific conditions so as to meet specific evidence obtaining requirements;
(2) Data analysis function: supporting deep analysis and interpretation of data in the physical mirror image, including file system analysis, metadata extraction and file recovery, so as to obtain more evidence obtaining information;
(3) Export and reporting functions: support exporting the extracted data into various common formats, such as text, images or PDF, while providing the functionality of generating detailed reports to facilitate the recording and sharing of the forensic process;
(4) Data verification function: the integrity and the accuracy of the physical mirror image are verified through comparison of a verification algorithm and the hash value, so that the reliability of data is ensured and the falsification is prevented;
(5) Batch processing function: physical mirror images of a plurality of FLASH chips are supported to be processed simultaneously, and data extraction efficiency and convenience are improved;
the Cyclic Redundancy Check (CRC) is adopted in the checking algorithm, and the process is as follows:
assuming that the data to be calculated is D, the CRC check code is CRC,
(1) Selecting a CRC generator polynomial G (x), typically expressed in binary form;
(2) Shifting D left by adding a plurality of zero bits to obtain data with additional zero bits, and marking the data as D';
(3) Initializing a register to 0, wherein the number of bits of the register is the same as that of the CRC generator polynomial G (x);
(4) Placing the first data bit of D' into the most significant bit of the register;
(5) Starting from the most significant bit of the register, the following operations are performed bit by bit:
if the current bit is the same as the highest bit of the CRC generator polynomial, shifting the register one bit to the left and setting the lowest bit to 0;
if the current bit is different from the highest bit of the CRC generation polynomial, shifting the register one bit to the left, setting the lowest bit to be 1, and performing exclusive OR operation on the register and the CRC generation polynomial;
(6) Continuing to perform the step 5 until all the bits of D' are processed;
(7) Finally, the value stored in the register is the CRC check code CRC;
hash value comparison adopts SHA-256 (secure HashAlgorithm 256-bit), SHA-256 is a safer and widely used hash algorithm, and is suitable for the fields of data integrity verification and password storage, and the following calculation formula of the SHA-256 algorithm is as follows:
assuming that the data to be hashed is D, the output hash value of SHA-256 is H,
(1) Initializing an internal state of SHA-256, including a set of initial constants and buffers;
(2) Converting the data D into a bit stream form according to a specified coding mode, typically binary;
(3) Preprocessing data:
adding a bit "1" at the end of D;
adding an appropriate number of "0" bits such that the data length satisfies a particular condition is typically an integer multiple of the 512 bit block length;
adding a bit string with the length of 64 bits, which indicates that the original length of the data D is in units of bits;
(4) Dividing the preprocessed data into a plurality of 512-bit blocks;
(5) The following operations are performed for each block:
initializing a message scheduling array and a working variable array;
performing 64 iterations, and updating the message scheduling array and the working variable array by using different algorithms and constants for each iteration;
(6) Connecting the work variable arrays processed by the last block to obtain a final 256-bit hash value H;
the specific implementation of the SHA-256 algorithm involves complicated calculation steps such as bit operation, logic function, circulation and the like, and is beyond the category of simple algorithm formulas, so the formulas are only general step outlines of the SHA-256 algorithm, and specific specifications and implementation details of the SHA-256 algorithm need to be referred to for actual implementation.
Preferably, the method comprises the following steps:
(1) Selecting a proper adapter according to the type of pins or contacts of the removed target Flash chip, electrically connecting the corresponding adapter to the top surface of the host, and connecting the target Flash chip with the corresponding adapter;
(2) The power supply is connected with the power interface through a 9V transformer, a 220V stabilized voltage power supply is supplied to the host, the host is connected with the computer through a USB data line and the USB interface, and the host is started by pressing the switch;
(3) Running the image extraction software on a computer, wherein the image extraction software selects the model of the Flash chip in an automatic or manual mode according to the need;
(4) The mirror image extraction software performs connection check, the connection condition of each pin or contact of the Flash chip is displayed in a software interface in an image mode, and a user adjusts the position of the Flash chip according to the diagram;
(5) After the adjustment is finished, the mirror image extraction software starts to read the data of the Flash chip, gradually reads the content of the whole chip according to a preset reading sequence and a data structure, transmits the read data to a computer through USB connection, stores the read data in a local memory of the computer through the mirror image extraction software, and performs physical mirror image on target data for a plurality of times and compresses and encrypts and stores the target data;
(6) And the image extraction software calls the stored physical image to recover the deleted data, and analyzes and completes the physical image data in the modes of data fragment analysis, unallocated space recovery, data reconstruction, file system analysis and data integrity verification.
The invention has the following beneficial effects:
(1) The chip-level extraction technology aims at the extraction of the storage chip, the storage chip can finish the extraction of sample data in good condition, mirror image data is transmitted to the computer through the equipment, the whole extraction process is free from the restriction of the original operation environment of the electronic equipment, the control of other hardware and software systems is avoided, the content of the FLASH storage chip of the mobile phone is directly read, the most original data is extracted, the method has outstanding capability in the aspect of processing damaged electronic equipment, and the complete mirror image file of the electronic equipment is ensured to be obtained.
(2) The traditional method carries out logic extraction through a USB cable, and software of a data communication type is required to be installed in the equipment, and user data in a machine body is transmitted through the software. The software will occupy a part of the memory of the mobile phone, and some deleted user data may be covered, so that the user data cannot be recovered completely. The extraction technique in the present invention is a read-only operation for the extraction of the memory chip, and thus the above-described problems are avoided.
(3) The physical mirror image extraction of the bottom layer of the chip has wide value and applicability, the FLASH chip is packaged in a ceramic sealing way, is extremely firm and durable, is extremely corrosion-resistant, and can still obtain the required information through the data extraction of the FLASH chip under extreme conditions (such as damage and corrosion); meanwhile, the invention has various types of chip adapters, can be matched with most FLASH chips on the market, and has wide application range.
(4) The chip type is automatically identified by intelligently measuring pins, identifications and identification capacities through software, the contact state of the chip pins is detected in real time and the simulation state is given, the contact state of the chip pins and an adapter can be automatically identified, and the physical mirror image extraction is fast and complete, so that complete data extraction of a conventional area, a hidden area and an encryption area of a FLASH chip is supported.
Drawings
FIG. 1 is a schematic diagram of a FLASH chip bottom physical mirroring device according to the present invention;
FIG. 2 is an enlarged schematic view of the structure of FIG. 1A according to the present invention;
FIG. 3 is a schematic diagram of the back result of the FLASH chip bottom physical mirroring device according to the present invention;
FIG. 4 is a schematic diagram of a BGA chip adapter of the present invention;
FIG. 5 is an interface diagram of an automatic chip selection by the image extraction software of the present invention;
FIG. 6 is an interface diagram of a manual selection chip of the image extraction software of the present invention;
FIG. 7 is an interface diagram of a mirror image extraction software chip connection check of the present invention;
FIG. 8 is an interface diagram of a mirror image extraction software chip data read in accordance with the present invention;
FIG. 9 is an interface diagram of a file saved by the image extraction software of the present invention;
fig. 10 is a step diagram of the present invention.
Detailed Description
The following description of the embodiments of the present invention will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present invention, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
Example 1
Referring to fig. 1 to 3, a physical mirror device for a FLASH chip bottom layer includes
The Flash chip adapter 2, the BGA chip adapter 3 and the EMMC chip adapter 4 are arranged at the top of the host 1, and an interface structure 5 is arranged at the back of the host 1;
the host 1 is responsible for the communication of a computer and the control of a memory chip;
the Flash chip adapter 2, the BGA chip adapter 3 and the EMMC chip adapter 4 are used for connecting the host 1 with a Flash chip of a specific type and providing a signal conversion function;
the interface structure 5 is used for being connected with a power supply and a computer so as to control the on-off of the power supply of the host 1;
the mirror image extraction software has a chip identification function, a chip connection checking function, a data reading function and an integrity checking function, wherein
The chip identification function is divided into automatic identification of FLASH chip type and manual selection of FLASH chip type, and detailed parameter information is displayed;
the chip connection checking function displays the pin states of the FLASH chip in a graphical interface mode, including various states of electrifying, poor contact, useless pins, pin short circuit and empty pins, and distinguishes the states in different colors;
the data reading function automatically performs physical image extraction through a software program, and stores the extracted data in a local computer;
the integrity check function performs integrity check using the mirror extracted data and performs necessary data complement.
Specifically, the host 2 is embedded with a two-way PWM supply voltage control system, a pin power supply control matrix, an IO control circuit for designing pins, and an Emacs chip control circuit.
Specifically, the Flash chip adapter 2 is applicable to an 8-pin chip set, a 20-pin chip set, BGA60A and TSOP48.
Specifically, the BGA chip adapter 3 includes a base 31, a roller 32, a mounting groove 33, a contact pin 34, a cover plate 35, a pressing plate 36 and a buckle 37, wherein the base 31 is electrically connected with the host 1, the roller 32 is rotationally connected to a side surface of the base 31, the mounting groove 33 is formed in a top surface of the base 31, the contact pin 34 is arranged in the mounting groove 33 in an array manner, the cover plate 35 is rotationally connected with the base 31, the pressing plate 36 is fixed on a surface of the cover plate 35, the pressing plate 36 is in snap connection with an inside of the mounting groove 33, the buckle 37 is rotationally connected to a side surface of the cover plate 35, and the buckle 37 is in snap connection with the roller 32.
Specifically, the EMMC chip adapter 4 is suitable for BGA-253, BGA-529, BGA-169, E, BGA-162.
Specifically, the interface structure 5 includes a switch 51, a power interface 52 and a USB interface 53, the switch 51 is disposed on the back of the host 1, the power interface 52 and the USB interface 53 are disposed on the back of the host 1, the switch 51 controls the power on-off of the host 1, a 220V regulated power is supplied to the host 1 through a 9V transformer connected with the power interface 52, and the host 1 is connected with a PC through the USB interface 53 to transmit the read data to the PC.
Specifically, the BGA chip adapter 3 is adapted for all BGA chips of the same pitch, and the mounting groove 33 is capable of mounting BGA chips of different sizes.
Specifically, the image extraction software supports multiple times of physical image extraction on the FLASH chip, so as to ensure data recovery and reconstruction under the condition of chip damage or error data reading, and has the following functions in the data reading process:
(1) Error handling function: in the process of physical image extraction, if errors or reading failures occur, the image extraction software can automatically identify and record the positions and reasons of the errors and try to re-read the data so as to improve the success rate of data extraction;
(2) Region selection function: the image extraction software allows a user to select a specific storage area to perform physical image extraction, wherein the physical image extraction comprises a whole chip, a specific sector, a block or a page, so that data recovery and reconstruction can be performed in a targeted manner;
(2) Data defragmentation function: in the process of multiple physical image extraction, the image extraction software can analyze and sort the extracted data fragments so as to restore the integrity and continuity of the original data as much as possible;
(4) Data restoration function: after multiple times of physical image extraction, the image extraction software can correct and repair the extracted data so as to eliminate the influence of errors or incomplete data and restore the accuracy and the integrity of the data as much as possible;
(5) Mirror image comparison function: the image extraction software can compare the data differences and changes between different physical images to determine the consistency and integrity of the data and provide detailed comparison reports.
Specifically, the image extraction software supports the recovery of deleted data, and performs comprehensive physical image extraction and data analysis on the FLASH chip in the modes of data fragment analysis, unallocated space recovery, data reconstruction, file system analysis and data integrity verification, so that part or all of the deleted data is effectively recovered.
Specifically, the image extraction software supports the compression and encryption of the physical image, so as to reduce the data storage space and improve the data security.
Specifically, the image extraction software also has the following functions:
(1) Data screening function: providing flexible data screening options, and allowing a user to screen and extract data in a physical mirror image according to specific conditions so as to meet specific evidence obtaining requirements;
(2) Data analysis function: supporting deep analysis and interpretation of data in the physical mirror image, including file system analysis, metadata extraction and file recovery, so as to obtain more evidence obtaining information;
(3) Export and reporting functions: support exporting the extracted data into various common formats, such as text, images or PDF, while providing the functionality of generating detailed reports to facilitate the recording and sharing of the forensic process;
(4) Data verification function: the integrity and the accuracy of the physical mirror image are verified through comparison of a verification algorithm and the hash value, so that the reliability of data is ensured and the falsification is prevented;
(5) Batch processing function: physical mirror images of a plurality of FLASH chips are supported to be processed simultaneously, and data extraction efficiency and convenience are improved;
the Cyclic Redundancy Check (CRC) is adopted in the checking algorithm, and the process is as follows:
assuming that the data to be calculated is D, the CRC check code is CRC,
(1) Selecting a CRC generator polynomial G (x), typically expressed in binary form;
(2) Shifting D left by adding a plurality of zero bits to obtain data with additional zero bits, and marking the data as D';
(3) Initializing a register to 0, wherein the number of bits of the register is the same as that of the CRC generator polynomial G (x);
(4) Placing the first data bit of D' into the most significant bit of the register;
(5) Starting from the most significant bit of the register, the following operations are performed bit by bit:
if the current bit is the same as the highest bit of the CRC generator polynomial, shifting the register one bit to the left and setting the lowest bit to 0;
if the current bit is different from the highest bit of the CRC generation polynomial, shifting the register one bit to the left, setting the lowest bit to be 1, and performing exclusive OR operation on the register and the CRC generation polynomial;
(6) Continuing to perform the step 5 until all the bits of D' are processed;
(7) Finally, the value stored in the register is the CRC check code CRC;
hash value comparison adopts SHA-256 (secure HashAlgorithm 256-bit), SHA-256 is a safer and widely used hash algorithm, and is suitable for the fields of data integrity verification and password storage, and the following calculation formula of the SHA-256 algorithm is as follows:
assuming that the data to be hashed is D, the output hash value of SHA-256 is H,
(1) Initializing an internal state of SHA-256, including a set of initial constants and buffers;
(2) Converting the data D into a bit stream form according to a specified coding mode, typically binary;
(3) Preprocessing data:
adding a bit "1" at the end of D;
adding an appropriate number of "0" bits such that the data length satisfies a particular condition is typically an integer multiple of the 512 bit block length;
adding a bit string with the length of 64 bits, which indicates that the original length of the data D is in units of bits;
(4) Dividing the preprocessed data into a plurality of 512-bit blocks;
(5) The following operations are performed for each block:
initializing a message scheduling array and a working variable array;
performing 64 iterations, and updating the message scheduling array and the working variable array by using different algorithms and constants for each iteration;
(6) Connecting the work variable arrays processed by the last block to obtain a final 256-bit hash value H;
the specific implementation of the SHA-256 algorithm involves complicated calculation steps such as bit operation, logic function, circulation and the like, and is beyond the category of simple algorithm formulas, so the formulas are only general step outlines of the SHA-256 algorithm, and specific specifications and implementation details of the SHA-256 algorithm need to be referred to for actual implementation.
Specifically, the detailed process includes the following steps:
(1) Selecting a proper adapter according to the pin or contact type of the removed target Flash chip, wherein the adapter comprises: the Flash chip adapter 2, the BGA chip adapter 3 and the EMMC chip adapter 4 are electrically connected to the top surface of the host, and the target Flash chip is connected with the corresponding adapter, when the Flash chip is connected with the BGA chip adapter, the Flash chip is firstly placed into the mounting groove 33 on the top surface of the base 31, so that the contact points of the Flash chip are mutually abutted with the contact pins 34, then the cover plate 35 is rotated, the cover plate 35 is pressed on the top surface of the base 31, the pressing plate 36 is tightly abutted against the Flash chip, and finally the pressing plate 36 is in clamping connection with the rolling shaft 32;
(2) The power supply is connected with the power interface 52 through a 9V transformer, 220V stabilized power supply is supplied to the host 1, the power supply is connected with the USB interface 53 through a USB data line, the host 1 is connected with a computer, the switch 51 is pressed down, and the host 1 is started;
(3) Running the image extraction software on a computer, wherein the image extraction software selects the model of the Flash chip in an automatic or manual mode according to the need;
(4) The mirror image extraction software performs connection check, the connection condition of each pin or contact of the Flash chip is displayed in a software interface in an image mode, and a user adjusts the position of the Flash chip according to the diagram;
(5) After the adjustment is finished, the mirror image extraction software starts to read the data of the Flash chip, gradually reads the content of the whole chip according to a preset reading sequence and a data structure, transmits the read data to a computer through USB connection, stores the read data in a local memory of the computer through the mirror image extraction software, and performs physical mirror image on target data for a plurality of times and compresses and encrypts and stores the target data;
(6) And the image extraction software calls the stored physical image to recover the deleted data, and analyzes and completes the physical image data in the modes of data fragment analysis, unallocated space recovery, data reconstruction, file system analysis and data integrity verification.
The foregoing is only a preferred embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art, who is within the scope of the present invention, should make equivalent substitutions or modifications according to the technical solution and the modified concept thereof, within the scope of the present invention.
Claims (12)
1. A FLASH chip bottom layer physical mirror image device is characterized in that: comprising
The Flash chip adapter (2), the BGA chip adapter (3) and the EMMC chip adapter (4) are arranged at the top of the host (1), and an interface structure (5) is arranged on the back of the host (1);
the host (1) is responsible for the communication of the computer and the control of the memory chip;
the Flash chip adapter (2), the BGA chip adapter (3) and the EMMC chip adapter (4) are used for connecting the host (1) with a Flash chip of a specific type and providing a signal conversion function;
the interface structure (5) is used for being connected with a power supply and a computer so as to control the on-off of the power supply of the host (1);
the mirror image extraction software has a chip identification function, a chip connection checking function, a data reading function and an integrity checking function, wherein
The chip identification function is divided into automatic identification of FLASH chip type and manual selection of FLASH chip type, and detailed parameter information is displayed;
the chip connection checking function displays the pin states of the FLASH chip in a graphical interface mode, including various states of electrifying, poor contact, useless pins, pin short circuit and empty pins, and distinguishes the states in different colors;
the data reading function automatically performs physical image extraction through a software program, and stores the extracted data in a local computer;
the integrity check function performs integrity check using the mirror extracted data and performs necessary data complement.
2. The FLASH chip bottom layer physical mirroring device according to claim 1, wherein: the host (2) is embedded with a double-path PWM power supply voltage control system, a pin power supply control matrix, an IO control circuit for designing pins and an Emacs chip control circuit.
3. The FLASH chip bottom layer physical mirroring device according to claim 1, wherein: the Flash chip adapter (2) is applicable to an 8-pin chip holder, a 20-pin chip holder, BGA60A and TSOP48.
4. The FLASH chip bottom layer physical mirroring device according to claim 1, wherein: BGA chip adapter (3) include base (31), roller (32), mounting groove (33), contact pin (34), apron (35), clamp plate (36) and buckle (37), base (31) with electric connection between host computer (1), roller (32) rotate connect in the side of base (31), mounting groove (33) are located the top surface of base (31), array is equipped with in mounting groove (33) contact pin (34), apron (35) with base (31) rotate to be connected, clamp plate (36) are fixed in the surface of apron (35), just clamp plate (36) block connect in the inside of mounting groove (33), buckle (37) rotate connect in the side of apron (35), just buckle (37) with roller (32) block connect.
5. The FLASH chip bottom layer physical mirroring device according to claim 1, wherein: the EMMC chip adapter (4) is suitable for BGA-253, BGA-529, BGA-169, E, BGA-162.
6. The FLASH chip bottom layer physical mirroring device according to claim 1, wherein: the interface structure (5) comprises a switch (51), a power interface (52) and a USB interface (53), wherein the switch (51) is arranged on the back of the host computer (1), the power interface (52) and the USB interface (53) are arranged on the back of the host computer (1), the switch (51) controls the power on-off of the host computer (1), 220V voltage-stabilized power is supplied to the host computer (1) through the connection of a 9V transformer and the power interface (52), and the host computer (1) is connected with a PC through the USB interface (53) to transmit read data to the PC.
7. The FLASH chip bottom layer physical mirroring device according to claim 4, wherein: the BGA chip adapter (3) is suitable for all BGA chips with the same spacing, and the mounting groove (33) can mount BGA chips with different sizes.
8. The FLASH chip bottom layer physical mirroring device according to claim 1, wherein: the image extraction software supports multiple times of physical image extraction on the FLASH chip so as to ensure data recovery and reconstruction under the condition of chip damage or error data reading, and has the following functions in the data reading process:
(1) Error handling function: in the process of physical image extraction, if errors or reading failures occur, the image extraction software can automatically identify and record the positions and reasons of the errors and try to re-read the data so as to improve the success rate of data extraction;
(2) Region selection function: the image extraction software allows a user to select a specific storage area to perform physical image extraction, wherein the physical image extraction comprises a whole chip, a specific sector, a block or a page, so that data recovery and reconstruction can be performed in a targeted manner;
(3) Data defragmentation function: in the process of multiple physical image extraction, the image extraction software can analyze and sort the extracted data fragments so as to restore the integrity and continuity of the original data as much as possible;
(4) Data restoration function: after multiple times of physical image extraction, the image extraction software can correct and repair the extracted data so as to eliminate the influence of errors or incomplete data and restore the accuracy and the integrity of the data as much as possible;
(5) Mirror image comparison function: the image extraction software can compare the data differences and changes between different physical images to determine the consistency and integrity of the data and provide detailed comparison reports.
9. The FLASH chip bottom layer physical mirroring device according to claim 1, wherein: the image extraction software supports the recovery of deleted data, and performs comprehensive physical image extraction and data analysis on the FLASH chip in the modes of data fragment analysis, unallocated space recovery, data reconstruction, file system analysis and data integrity verification, so that part or all of the deleted data is effectively recovered.
10. The FLASH chip bottom layer physical mirroring device according to claim 1, wherein: the image extraction software supports the compression and encryption of the physical image, so as to reduce the data storage space and improve the data security.
11. The FLASH chip bottom layer physical mirroring device according to claim 1, wherein: the image extraction software also has the following functions:
(1) Data screening function: providing flexible data screening options, and allowing a user to screen and extract data in a physical mirror image according to specific conditions so as to meet specific evidence obtaining requirements;
(2) Data analysis function: supporting deep analysis and interpretation of data in the physical mirror image, including file system analysis, metadata extraction and file recovery, so as to obtain more evidence obtaining information;
(3) Export and reporting functions: support exporting the extracted data into various common formats, such as text, images or PDF, while providing the functionality of generating detailed reports to facilitate the recording and sharing of the forensic process;
(4) Data verification function: the integrity and the accuracy of the physical mirror image are verified through comparison of a verification algorithm and the hash value, so that the reliability of data is ensured and the falsification is prevented;
(5) Batch processing function: physical mirror images of a plurality of FLASH chips are supported to be processed simultaneously, and data extraction efficiency and convenience are improved;
wherein the checking algorithm adopts Cyclic Redundancy Check (CRC), and the process is as follows:
assuming that the data to be calculated is D, the CRC check code is CRC,
(1) Selecting a CRC generator polynomial G (x), typically expressed in binary form;
(2) Shifting D left (adding several zero bits) to obtain data with additional zero bits, denoted D';
(3) Initializing a register to 0, wherein the number of bits of the register is the same as that of the CRC generator polynomial G (x);
(4) Placing the first data bit of D' into the most significant bit of the register;
(5) Starting from the most significant bit of the register, the following operations are performed bit by bit:
if the current bit is the same as the highest bit of the CRC generator polynomial, shifting the register one bit to the left and setting the lowest bit to 0;
if the current bit is different from the highest bit of the CRC generation polynomial, shifting the register one bit to the left, setting the lowest bit to be 1, and performing exclusive OR operation on the register and the CRC generation polynomial;
(6) Continuing to perform the step 5 until all the bits of D' are processed;
(7) Finally, the value stored in the register is the CRC check code CRC;
hash value comparison adopts SHA-256 (secure HashAlgorithm 256-bit), SHA-256 is a safer and widely used hash algorithm, and is suitable for the fields of data integrity verification and password storage, and the following calculation formula of the SHA-256 algorithm is as follows:
assuming that the data to be hashed is D, the output hash value of SHA-256 is H,
(1) Initializing an internal state of SHA-256, including a set of initial constants and buffers;
(2) Converting the data D into a bit stream form according to a specified coding scheme (usually binary);
(3) Preprocessing data:
adding a bit "1" at the end of D;
adding an appropriate number of "0" bits such that the data length satisfies a particular condition (typically an integer multiple of a 512 bit block length);
adding a bit string of 64 bits in length, representing the original length (in bits) of the data D;
(4) Dividing the preprocessed data into a plurality of 512-bit blocks;
(5) The following operations are performed for each block:
initializing a message scheduling array and a working variable array;
performing 64 iterations, and updating the message scheduling array and the working variable array by using different algorithms and constants for each iteration;
(6) Connecting the work variable arrays processed by the last block to obtain a final 256-bit hash value H;
the specific implementation of the SHA-256 algorithm involves complicated calculation steps such as bit operation, logic function, circulation and the like, and is beyond the category of simple algorithm formulas, so the formulas are only general step outlines of the SHA-256 algorithm, and specific specifications and implementation details of the SHA-256 algorithm need to be referred to for actual implementation.
12. The method for extracting the bottom physical mirror image of the FLASH chip according to claim 7, wherein the method comprises the following steps: the method comprises the following steps:
(1) Selecting a proper adapter according to the type of pins or contacts of the removed target Flash chip, electrically connecting the corresponding adapter to the top surface of the host, and connecting the target Flash chip with the corresponding adapter;
(2) The power supply is connected with the power interface through a 9V transformer, a 220V stabilized voltage power supply is supplied to the host, the host is connected with the computer through a USB data line and the USB interface, and the host is started by pressing the switch;
(3) Running the image extraction software on a computer, wherein the image extraction software selects the model of the Flash chip in an automatic or manual mode according to the need;
(4) The mirror image extraction software performs connection check, the connection condition of each pin or contact of the Flash chip is displayed in a software interface in an image mode, and a user adjusts the position of the Flash chip according to the diagram;
(5) After the adjustment is finished, the mirror image extraction software starts to read the data of the Flash chip, gradually reads the content of the whole chip according to a preset reading sequence and a data structure, transmits the read data to a computer through USB connection, stores the read data in a local memory of the computer through the mirror image extraction software, and performs physical mirror image on target data for a plurality of times and compresses and encrypts and stores the target data;
(6) And the image extraction software calls the stored physical image to recover the deleted data, and analyzes and completes the physical image data in the modes of data fragment analysis, unallocated space recovery, data reconstruction, file system analysis and data integrity verification.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310811490.2A CN116842589A (en) | 2023-07-04 | 2023-07-04 | FLASH chip bottom layer physical mirror image extraction method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310811490.2A CN116842589A (en) | 2023-07-04 | 2023-07-04 | FLASH chip bottom layer physical mirror image extraction method and device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116842589A true CN116842589A (en) | 2023-10-03 |
Family
ID=88161219
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310811490.2A Pending CN116842589A (en) | 2023-07-04 | 2023-07-04 | FLASH chip bottom layer physical mirror image extraction method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116842589A (en) |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102136296A (en) * | 2011-02-21 | 2011-07-27 | 北京理工大学 | Method for identifying metadata format of NANDFlash memory chip |
| WO2011090012A1 (en) * | 2010-01-22 | 2011-07-28 | 株式会社日立製作所 | Solid state drive device and mirrored-configuration reconfiguration method |
| CN103544082A (en) * | 2013-10-28 | 2014-01-29 | 公安部第三研究所 | Memory device data recovery achieving method based on flash memory chip |
| CN106201774A (en) * | 2016-06-28 | 2016-12-07 | 中国人民解放军61660部队 | A kind of NAND FLASH storage chip data store organisation analyzes method |
| CN114721877A (en) * | 2022-04-25 | 2022-07-08 | 广州小鹏汽车科技有限公司 | Software fault tolerance recovery method, device, equipment and storage medium |
-
2023
- 2023-07-04 CN CN202310811490.2A patent/CN116842589A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2011090012A1 (en) * | 2010-01-22 | 2011-07-28 | 株式会社日立製作所 | Solid state drive device and mirrored-configuration reconfiguration method |
| CN102136296A (en) * | 2011-02-21 | 2011-07-27 | 北京理工大学 | Method for identifying metadata format of NANDFlash memory chip |
| CN103544082A (en) * | 2013-10-28 | 2014-01-29 | 公安部第三研究所 | Memory device data recovery achieving method based on flash memory chip |
| CN106201774A (en) * | 2016-06-28 | 2016-12-07 | 中国人民解放军61660部队 | A kind of NAND FLASH storage chip data store organisation analyzes method |
| CN114721877A (en) * | 2022-04-25 | 2022-07-08 | 广州小鹏汽车科技有限公司 | Software fault tolerance recovery method, device, equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104166636B (en) | Memory storage device and restoration method thereof and memory controller | |
| TWI312464B (en) | ||
| TW201243590A (en) | Data writing and reading method, memory controller and memory storage apparatus | |
| TWI443517B (en) | Memory stroage apparatus, memory controller and password verification method | |
| CN102760099B (en) | Method for writing data, Memory Controller and memorizer memory devices | |
| TW200915331A (en) | Managing bad blocks in various flash memory cells for electronic data flash card | |
| TW201346551A (en) | Data processing method, and memory controller and memory storage apparatus using the same | |
| CN116842589A (en) | FLASH chip bottom layer physical mirror image extraction method and device | |
| CN109491828A (en) | Coding/decoding method, memory storage apparatus and memorizer control circuit unit | |
| CN102591737B (en) | Data writing and reading method, memory controller and memory storage device | |
| JPH11502957A (en) | System for providing a readable and writable personal storage device | |
| CN102446137A (en) | Data write-in method, memory controller and memory storage device | |
| CN103324581B (en) | Memory cells and method for reading data, Memory Controller and storage device | |
| CN107331420A (en) | Coding/decoding method, memory storage apparatus and memorizer control circuit unit | |
| TW201939287A (en) | Block management method, memory control circuit unit and memory storage apparatus | |
| CN109273033A (en) | Storage management method, memorizer control circuit unit and memory storage apparatus | |
| CN109783001B (en) | Data encoding method, data decoding method, and storage controller | |
| WO2019007315A1 (en) | Data writing method in flash memory device, and device | |
| KR101111400B1 (en) | Apparatus and method for recovering the data of embeded system | |
| CN103034594A (en) | Memory storage device and memory controller and password authentication method thereof | |
| CN109559774A (en) | Coding/decoding method, memorizer control circuit unit and memory storage apparatus | |
| CN109032957A (en) | Storage management method, memorizer control circuit unit and memory storage apparatus | |
| CN110275801B (en) | Data recovery method, device, system, computer equipment and storage medium | |
| CN103985403B (en) | Work clock changing method, Memory Controller and memory storage apparatus | |
| CN102375943B (en) | Identification code generation method, memory management method, controller and storage system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |