IN-SYSTEM PROGRAMMING (ISP) FORENSICS
What Students Will Learn in This 5 Day Training
- Students will gain a comprehensive understanding and the skills to perform ISP extractions from devices with eMMC and eMCP memory.
- Students learn how to determine if a cell phone supports the ISP process, locate the ISP connection points, then using a hardware / software combination of tools, connect to the phone and download its contents.
- Students are provided with three sets of phones to perform chip-off extractions to understand tracing & connection points.
- Students will remove chips from devices, locate ISP connection points using back tracing techniques, and then apply the ISP process to an identical phone to download the flash memory.
- Students learn finer precision soldering skills as they solder to the resistors and capacitors of the PCB. And practice, practice, practice!
***Pre-requisites: Students should have basic soldering skills and be comfortable working at the PCB level***
ISP Course Details
- Course Code: AT-ISP
- Duration: 5 Days
- Laptop Required?: Yes
- This class is for Sworn Law Enforcement only
The instructor was very knowledgeable and presented the material at a good pace. The instructor also made himself available before and after class for any extra time or help that was needed.ISP - Toronto 2017
What is ISP?
ISP “In-System Programming” applied to forensics, is the practice of connecting to an eMMC or eMCP flash memory chip for the purpose of downloading a device’s complete memory contents. eMMC and eMCP memory are the standard in today’s smartphones, and the ISP practice enables examiners to directly recover the complete data without removing the chip and destroying the device. ISP benefits the examiner who faces the challenges of tightening budgets, yet wants to expand their expertise in retrieving evidence from locked smartphones. A cost-effective technique, ISP provides examiners with the same results of a chip-off at a lower price-point. And just like with JTAG and Chip-Off, your agency can still use its current line-up of forensic analysis software to recover that ’smoking gun’ piece of evidence. No need to purchase additional analysis software.
Why Do We Need ISP?
ISP Enables examiners to bypass lock codes, and recover a complete data collection from phones not supported by JTAG or commercial tools.
- ISP Enables examiners to bypass lock codes, and recover a complete data collection from phones not supported by JTAG or commercial tools.
- It’s a non-destructive practice that achieves the same results as a chip-off, while leaving the original evidence intact.
- Acquires data much faster than JTAG, enabling examiners to process more phones faster.
- Less resources and tools are required to perform an ISP download compared to Chip-Off.
We prefer students bring their own laptops whenever possible. If this is not possible, Teel Tech Canada will provide one for you. If you are unable to bring your own laptop, please indicate so on the registration page.
- Windows 7
- Windows 8.x and 10.x using these instructions (turn off driver sig enforcement)
- macOS with Bootcamp Windows 7
- macOS with Bootcamp Windows 8.x and Win 10.x using these instructions
- macOS alone will not work (No Virtual Machines)
- 8GB RAM (minimum)
- 100GB storage (minimum)
- You must have Admin rights or have the admin password for software installation.
- NOTE: ALL Windows updates should be done prior to class
This class is for Sworn Law Enforcement ONLY.
For questions regarding this policy, please contact us at firstname.lastname@example.org or (250) 893-6125