Sub-topic 1. NAND/NOR Chip Forensics

Mobile devices are increasingly utilized in criminal and terrorist activities. These devices are an important source of evidence to law enforcement officers and forensic examiners. Since inception, viaForensics has developed innovative tools and techniques for officers and examiners leveraging the latest technologies in mobile device forensics. viaForensics has previously developed forensically sound tools and techniques for analyzing NAND flash memory in Android mobile devices, and is uniquely positioned and prepared to extend this research. One of the primary challenges in forensic imaging of flash memory is that, unlike mechanical hard disks, flash memory is in a constant state of flux. Memory management transactions are ongoing within the memory independent of external activity. viaForensics proposes to continue its innovation by conducting research and development efforts toward creation of a NAND memory write blocker, as well as tools and techniques for complete, bit-by-bit forensic imaging of NAND flash memory chips. In Phase I, viaForensics will research expanding the existing tools and techniques to include the ability to decipher the wear leveling and other memory management algorithms of NAND flash memory. The research will also include investigation and feasibility analysis of methods for implementing a NAND memory write blocker. In phase II, the tools and techniques will be further developed for use on a wider range of devices and flash memory types, and a prototype of the NAND memory write blocker will be developed.