Mobile phone forensic analysis–analysis of JTAG and Chip Off images of Android YAFFS Flash

On 18 October 2012 I presented, at the Breakpoint 2012conference, some preliminary results of research I have been undertaking in the area of forensic acquisition and analysis of mobile phones. Specifically I have been focusing on Android phones using NAND flash memory and the YAFFS2 file system. The seminar principally addressed methods of acquisition (JTAG and Chip Off) and the fundamental challenges of reconstructing YAFFS2 file systems from said acquisitions. The slides from the presentation can be found here.

 

Object Headers Slide Screenshot

If you are currently undertaking work in this area and having trouble interpreting any flash images, I would be happy to hear from you.