4 ms·
The described cellebrite tool is not used to read chips removed from the board, it attaches to an unopened, unmodified phone over a standard external interface
by PeterisP 6y ago
The described cellebrite tool is not used to read chips removed from the board, it attaches to an unopened, unmodified phone over a standard external interface and extracts data over that.
- polar 6y agoCellebrite's "Physical Analyzer" can parse imported data, including disk images and chip images.
- PeterisP 6y agoIn that case it can't alter any evidence in an undetectable way - it can't alter the disk or chip itself; and it can't alter the image without changing the (already recorded offline) image hashes.
- sitkack 6y agoHow do you know that? If the imported data pops the host process, it could take over the host and mount the phone read/write.
- georgeplusplus 6y agoI understand that. My intent was to point out the difference between traditional digital forensics and what cellibrite does.