This article has been accepted for publication in IEEE Transactions on Information Forensics and Security.

This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/TIFS.2022.3176187

Experimental Evaluation of e·MMC Data Recovery

Aya Fukami1,3 , Sasha Sheremetov2 , Francesco Regazzoni3,4 , Zeno Geradts1,3 , and Cees de Laat3
1
Netherland Forensic Institute, Den Haag, The Netherlands
2
Rusolut Sp. z o.o., Warsaw, Poland
3
University of Amsterdam, Amsterdam, The Netherlands
4
Universita della Svizzera Italiana

Abstract—In this paper, we explore the data recovery pro- age). Of those devices, e·MMCs are currently most popularly
cedures from e·MMCs. The e·MMC is one of the “managed” embedded in mobile devices [10]–[12].
flash memory devices that are popularly used in modern digital An e·MMC consists of flash memory and a flash controller
devices as their storage media. The e·MMC, which consists of
flash memory and the flash memory controller, optimizes the embedded into one IC (Integrated Circuit) chip. Its specifica-
data input/output between the host device and the non-volatile tions are defined by JEDEC (Joint Electron Device Engineer-
memory through its standardized protocol. Its standardized ing Council) Solid State Technology Association [13]–[15].
structure and protocol makes forensic physical data acquisition The embedded flash memory stores the data, and its operation
simpler than handling the raw flash memory. However, its secure is controlled by the flash controller. While directly controlling
data purging features, such as Secure Erase and Sanitize, make
data recovery from e·MMC a challenging task. In this research, flash memory requires various data optimization processes and
we investigate inside the e·MMCs, and evaluate advanced data crafting vendor specific commands which vary by production,
recovery procedures. By reverse engineering the structures of with the aid of the flash memory controller, the host system
e·MMCs and accessing the internal flash memory, we discover can control the target memory by simply issuing standardized
that securely erased data is still recoverable from the internal commands. When acquiring the physical image of the target
flash memory. In some models, more than 99% of the securely
erased data can still be recoverable by accessing the flash memory device from the e·MMC for forensic analysis, commands are
inside the e·MMCs. The data extraction method, along with therefore issued to the target eMMC through e·MMC interface,
experimental data recovery evaluation, will be explored in this and they are translated by the flash memory controller. Then
paper. the forensic examiner can acquire the image that is already
Index Terms—chip-off forensic, [Link], physical image acqui- optimized by the flash controller.
sition, mobile forensic, deleted data recovery While the standardized protocol makes physical acquisition
simpler than handling the raw flash memory directly, the struc-
ture of the e·MMC gives several challenges to forensic data
I. I NTRODUCTION
recovery. First, since the internal flash memory is inaccessible
In digital forensics, recovering deleted data from the target through the e·MMC interface, the data that is equivalent to
devices is one of the critical tasks. Forensic data recovery is the traditional physical data cannot be acquired. The physical
typically performed by accessing and carving the unallocated data acquired through the e·MMC interface is the result of raw
data on the storage media on the target device [1]–[5]. When data processing by the flash controller. The acquired image is
a set of data is logically deleted, it is flagged as deleted by the typically in the form which the host system can directly rec-
system, but the actual data itself remains on the storage media. ognize [7]). Since the flash controller only passes the allocated
Therefore, forensic examiners often attempt to recover deleted area in the flash memory, unallocated area is inaccessible.
data by acquiring physical data. Physical data is a bit-by-bit Second, multiple erase commands are implemented in e·MMC
copy of the storage media of the target device, which allows specifications. One of them is Secure Erase, which is defined
examiners access the entire address space of the memory. By as the command to erase the data in the target addresses, as
accessing the physical data, forensic examiners may recover well as the copies of them, to be purged immediately when it
data that has been logically, but not necessarily physically is issued. Once this command is issued on the target device,
deleted data [5]–[8]. the erased data becomes completely inaccessible through the
Traditionally, flash memory has been the most popular e·MMC interface, which in turn greatly degrade the forensic
target device of the physical data acquisition in the mobile data recovery rate.
digital devices [3], [5], [9]. In the modern digital devices, To illustrate the difference in forensic data recovery rate,
instead of the raw flash memory, “managed” flash memory is typical forensic data extraction methods are categorized in
commonly used as the storage device. Modern digital devices Fig. 1. When logical data extraction is performed, logically
include smartphones, tablets, navigation systems, and other available data, such as individual files and databases, are
IoT devices. Examples of managed memory devices include extracted from available user interfaces on the target devices.
SSD (Solid State Drive), UFS (Universal Flash Storage), The data is therefore in a form which can be visualized
e·MMC (Embedded Multi Media Card), e·MCP (Embedded through appropriate application software. As shown in the Fig.
Multi Chip Package), and uMCP (UFS-based Multi Chip Pack- 1, the minimum amount of data is to be collected from the

© 2022 IEEE. Personal use is permitted, but republication/redistribution requires IEEE [Link] [Link] for more information.
 This article has been accepted for publication in IEEE Transactions on Information Forensics and Security. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/TIFS.2022.3176187

target device, and no deleted data is acquired in logical data the PCB (Printed Circuit Board) of the target system. Through
extraction. When methods are available and deleted data needs our experiments, we find that securely erased data on e·MMCs
to be recovered, a forensic examiner proceeds to acquiring is still recoverable by extracting the internal memory data and
wider range of data, typically at the file system level, which is post-processing it. Our main achievements presented in this
shown as the second level in Fig. 1. By acquiring data at file paper are:
system level, logically-deleted or some parts of unallocated • We demonstrate the procedure to identify the physical
data can be recovered, along with existing data. Typically no structure inside an e·MMC and to extract the physical
invasive hardware modification is required when performing data from the internal flash memory
file system based acquisition. The last and the most invasive • We design an architecture where both e·MMC protocols
step of data acquisition is physical data acquisition. Physical and internal flash memory protocols are controlled di-
data extraction acquire the entire memory area of the storage rectly
memory. Therefore all the existing data at the system level • We experimentally validate the techniques to prove that
becomes available, giving more chance for the examiners to data is still recoverable after it is securely erased on the
recover deleted data by examining the whole system data [10]. target e·MMC.
When the physical data is acquired from a digital device in The rest of the paper is structured as follows. In section II,
which an e·MMC is implemented as the storage, the data is the structure of an e·MMC is explained. In section III, methods
acquired through its interface, either through ISP (In-System to access the internal flash memory inside an e·MMC are
Programming), debug ports on the system, or by chip-off described. Then our experimental evaluation of data recovery
[10]. All of those acquisition techniques typically require from physical data is shown along with the test procedures in
hardware modification, therefore it is only performed when section IV and V. Finally, the results are discussed in section
truly necessary. In normal circumstances, this physical data VI.
extraction is the utmost broadest data acquisition method used
in forensic data recovery. However, as discussed before, given II. E·MMC I NTERNALS
the structure of the e·MMC, the extracted data through normal
In this section, we describe the overview of the e·MMC
physical acquisition is still a part of the real physical data
architectures which are defined by JEDEC Solid State Tech-
that is stored inside the e·MMC. In other words, more data is
nology Association [13]–[15]. e·MMCs are typically pack-
possibly available in the memory device itself. This is shown
aged into 12mm×16mm, 12mm×18mm, 14mm×18mm, or
as the dotted line in Fig. 1.
11.5mm×13mm BGA(Ball Grid Array) IC package.

Hidden Data Inside Physical Memory Device

A. e·MMC Organization
Physical Data
Fig. 2a and Fig. 2b each shows the top- and bottom- view
File System Data of an e·MMC in 11.5mm×13mm package. 30 of the 153
ball connectors shown in 2b are assigned to the standardized
Logical Data signals, including Vdd and GND. The assigned pin names
are shown in Fig. 2c. When controlling an e·MMC, the host
system sends commands to the e·MMC through those signal
pins. Signals required for communicating with the e·MMC are
CMD (Command), CLK (Clock) and DAT[0-7] (Data). The
CLK is the input signal from the host system, while CMD
Fig. 1. Concept of categorizing data for forensic extraction. While physical and DAT are the shared bidirectional signal between the host
data extraction is regarded as the method which provide widest range of data, controller and the card. To control an e·MMC, the host system
we introduce a method where wider data can be recoverable.
sends a 48-bit long command on the CMD line. Each bit of the
In this paper, we focus on this hidden data inside an command is sampled at the rising edge of the clock signal on
e·MMC. Since the internal physical memory inside an e·MMC CLK line. Responding to the commands from the host system,
is not accessible through the normal use, first we need to the e·MMC returns a response on the CMD line. The length of
reverse-engineer the hardware structure of the target memory the response can be either 48 bits or 136 bits. When reading
device. While the hardware specification is standardized for and writing data, the data is transferred on the DAT lines
managed flash devices, the internal structure differs by the after the command is acknowledged by the e·MMC. The data
model and the manufacturer. Intensive reverse-engineering is bus width is configurable either 1 bit (using only DAT[0]),
thus required. We therefore investigate the internal structure 4 bits (DAT[3:0]), or 8 bits (DAT[7:0]). 64 commands are
of e·MMCs to identify and to have the deep understanding available in total [14]. In addition to the standard commands,
of the data recovery method by accessing the internal flash manufacturers can also implement vendor-specific commands.
memory. We explore the method to directly extract data from Vendor-specific commands are typically implemented for spe-
flash memory inside e·MMCs, and evaluate how much data cial operation such as Smart report and RAM read/write [16].
can be recoverable after erasure. Extraction of the internal An e·MMC package consists of flash memory and a flash
raw flash memory data can be achieved without damaging the memory controller. The concept of the e·MMC internal struc-
target e·MMC, as long as the target e·MMC is detached from ture of an e·MMC is shown in Fig. 3. As seen from the Fig.

© 2022 IEEE. Personal use is permitted, but republication/redistribution requires IEEE [Link] [Link] for more information.
 This article has been accepted for publication in IEEE Transactions on Information Forensics and Security. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/TIFS.2022.3176187

e∙MMC

CLK
CMD
DAT[7:0]
Flash Controller
Flash Memory

(a) e·MMC Top View (b) e·MMC Bottom View

D0 D1 D2 RFU RFU

D3 D4 D5 D6 D7
Fig. 3. The illustrated structure of an e·MMC. e·MMC interface signal pins
VDDI Vss RFU VDD
are connected to the flash controller, which is responsible for controlling flash
memory. Note that flash memory may consist of multiple memory dies.
RFU VDDF Vss RFU RFU RFU

VDDF RFU

Vss RFU
modifies the original data prior to storing it to the flash
RFU Vss
memory.
RFU VDDF

RSTN RFU RFU Vss VDDF RFU

• Error correction: NAND flash memory data reliability
VDD CMD CLK
issues have been widely researched, and it is known that
Vss VDD Vss
multiple bit errors occur to the stored data in NAND flash
VDD Vss VDD Vss RFU RFU memory [18], [19]. Therefore, flash memory controllers
are required to have error correcting capabilities imple-
(c) e·MMC Ball Assignment mented. The required error correction capability is speci-
Fig. 2. Example of an e·MMC in 11.5mm×13mm Package. An e·MMC can
fied by the flash memory vendors. Error Correction Codes
be controlled by 10 signals (CLK, CMD, DAT[7:0]). Each signal is assigned (ECC) such as Bose-Chaudhuri-Hocquenghem (BCH)
to one of the 153 ball connectors that are visible in 2b. The detailed pin codes are popularly implemented by the flash memory
assignment is shown in 2c
controller inside e·MMCs. The parameters used in the
BCH are vendor-specific and vary by models. The flash
3, the e·MMC interface described above is the interface of memory controller computes the ECC when storing data
the flash controller. The commands and data sent from the into flash memory, and stores the computed codewords
host system are translated by the flash memory controller, along with the data itself.
which then performs data read and write to the flash memory, • Data randomization: In a flash memory cell, data is
where the actual data is stored in an non-volatile manner. stored in the form of electrical charge. Then those cells
Traditionally, flash memory and the memory controller have are connected in serial in flash memory to form pages
been packaged into individual IC chips. Therefore, consumer and blocks (section II-C). Therefore low entropy in data
device vendors are required to place two components when creates imbalanced charge states between neighboring
designing their products. Furthermore, flash memory control- cells, making stored data more susceptible to bit errors.
ling protocols differ by vendors/products. With development of In order to reduce the cell-to-cell interference, the flash
e·MMC, device manufacturers can not only use wider area of memory controller transforms the data into a random
the circuit board, but also can simplify the designing process values before storing it into the flash memory [20]. The
by using the standardized controlling protocols of a storage main purpose of data randomization is to avoid the same
media. data being stored in succession of flash memory ad-
dresses. The flash controller inside e·MMC transforms the
data by computing the XOR value between the data and
B. Flash memory controller the pseudo-random data. Linear Feedback Shift Register
As discussed above, the flash memory controller in an (LFSR) is typically used to produce the pseudo-random
e·MMC is responsible for communicating with the host device data. The structure and the initial value of the LFSR vary
and the flash memory. The flash memory controller optimizes by models.
the communication between the e·MMC and the host system, • Wear Leveling: Bit error count in flash memory increases
and takes care of read/write operation to the internal flash along with the number of write/erase cycles [21], [22].
memory. Not only it works as a flash translate layer (FTL) Therefore, in order to extend the lifetime of the flash
[17], the flash memory controller performs other operations memory, the flash memory controller normalizes the
in order to optimize the performance, as well as to keep write/erase count of each physical flash memory address.
the integrity of the stored data. From the digital forensic To help translate the flash memory physical addresses into
standpoint, the following operations performed by the flash the logical image addresses, the flash memory controller
memory controller are most important, as each operation records the logical address along with the actual data into

© 2022 IEEE. Personal use is permitted, but republication/redistribution requires IEEE [Link] [Link] for more information.
 This article has been accepted for publication in IEEE Transactions on Information Forensics and Security. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/TIFS.2022.3176187

the flash memory. controller first need to move the valid data into another block,
The original data sent from the host system to the e·MMC then erase the entire block of data. Therefore, there is a great
is processed at least with above mentioned operations, then chance that erased data at the e·MMC level could still remain
the flash memory controller stores the processed data into in flash memory.
flash memory. Therefore, when recovering the original data
from the flash memory for digital forensic purposes, a forensic D. Erasing data on an e·MMC
examiner needs to re-process the data after directly extracting
it from flash memory. The typical flows of procedures are: Several commands are available in the e·MMC standards
bit error correction with ECC, data de-randomization with to perform data erasure. By sending one of the following
LFSR, and then data sorting using the logical block numbers. command sets, the host system can directly delete data stored
Identifying the required parameters for each operation requires in the target e·MMC [13], [14].
mathematical approach, as reported in [23]. • Erase: Erase operation, along with other secure data
purge operation, typically uses the combination of
C. Flash Memory three commands: ERASE GROUP START(CMD35),
ERASE GROUP END(CMD36), and ERASE(CMD38).
Flash memory holds actual data after it is transformed
The host defines the start and end addresses of the
by the controller as described in the previous section. In
blocks to be deleted using CMD35 and CMD36. Then
flash memory, data is stored in a form of electrical charge
issues CMD38 in order to execute the appropriate erase
in transistors, which are typically called memory cells. The
operation. In Erase operation, no argument is set in
amount of trapped charge in a cell decides the data value.
CMD38. After receiving CMD38, the controller either
The data value of each flash memory cell can be 1 bit (0 or
deletes the data immediately, or at a convenient time.
1) for single level cell, 2 bits (0b00 to 0b11) for multi-level
• Secure Erase: Same as the Erase command, secure erase
cell, or more bits depending on the defined technology of the
uses CMD38 together with CMD35 and CMD36. When
target memory. Flash memory can be controlled by the signals
issuing CMD38, argument 0x80000000 is set in order to
shown in Table I [24].
make the e·MMC controller perform the Secure Erase
operation immediately. If there exist copies of the data
TABLE I
NAND FLASH MEMORY BASIC SIGNALS that is to be erased, the controller also deletes them once
CMD38 is issued.
Pin Name∗ Input/Output Description
• Trim: Trim is similar to Erase command. Addresses
WP n Input Write Protect
ALE Input Address Latch Enable
are set by CMD35 and CMD36, and the Trim oper-
CE n Input Chip Enable ation is performed by issuing CMD38 with argument
WE Input Write Enable 0x00000001. Once Trim is performed, the data in the
RY/BY n Output Ready/Busy
RE n Input Read Enable
target addresses is overwritten by 0 or 1. The controller
CLE Input Command Latch Enable can decide either performing the operation immediately,
I/O[7:0] Input/Output Data Input/Output or at a convenient timing. Since Trim itself is not a
∗“
secure data purge operation, it is typically performed in
n” after the signal name means that the signal is active low.
combination with Sanitize operation.
• Secure Trim: Secure Trim is performed in two steps. In
Multiple CE n and/or RY/BY n signals may exist in one the first step, the addresses where the data to be purged
e·MMC. When multiple flash memory dies (a die is a fabri- is stored are marked with CMD35 and CMD36. Then
cated integrated circuit) are implemented in an e·MMC, CE n CMD38 with argument 0x80000001 is issued to complete
is used as a multiplexer to activate the target die, while other the first step. Data erase is not performed at this point.
signals are typically shared among multiple dies. Reading or This first step can be repeated until all the addresses to be
writing operation is performed by page in flash memory. A trimmed are flagged. In the second step, again CMD35,
page is a group of memory cells that are connected in serial. 36 with addresses are issued, followed by CMD 38 with
While the page size varies on each model, typically 1 page argument 0x80008000. By issuing this command, the
consists of 4K to 16K bytes of data in modern flash memory. secure purge is performed on the marked blocks. Any
When erasing data in flash memory, however, it needs to be copies of those blocks are also purged. While CMD38
performed at block granularity. A block consists of multiple performs the erase operation right away in Secure Erase,
pages which are typically 128, 256 or 258 pages depending on in Secure Trim, the actual erase operation is held until the
the structure of the target flash memory. Due to the difference second step commands are issued. Therefore, Secure Trim
in operation granularity between writing and erasing, even can be more efficient than Secure Erase when erasing
when the data erase command is issued from the host system multiple fragmented erase groups [25].
to the e·MMC, most of the time the actual data stored in the • Sanitize: Sanitize command was introduced in the
flash memory cannot be erased right away. It is typically the e·MMC version 4.5. In [14], the Sanitize operation is
case that the flash memory block which stores the erased data defined as the command which physically removes data
in one of its pages also stores other valid data in other pages. In from the unmapped user address space. The sanitize
order to erase data at the flash memory level, the flash memory operation can be initiated by writing a non-zero value into

© 2022 IEEE. Personal use is permitted, but republication/redistribution requires IEEE [Link] [Link] for more information.
 This article has been accepted for publication in IEEE Transactions on Information Forensics and Security. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/TIFS.2022.3176187

“SANITIZE START” register of the extended CSD (Card

Specific Data) by using SWITCH (CMD6) command.
Sanitize command is recommended to use in combination
with Trim command.
In [14], it is stated that e·MMC version 4.51 and higher
should use Sanitize combined either with Erase or Trim instead
of Secure Erase and Secure Trim. After the Sanitize operation,
data should be physically removed from the unmapped user
address space. Fig. 5. Image of the cross-sectional structural view of an eMMC. One or
more flash memory dies and the flash memory controller die are connected
to the PCB through bonding wires.
III. E XTRACTING DATA FROM F LASH M EMORY IN AN
e·MMC
Since the physical data of an e·MMC is stored in the internal molds. An image of the cross-sectional view of an e·MMC is
flash memory, acquiring the physical flash memory data lets shown in fig. 5.
us analyze the remnants of data after data purge operation is As metal material is used in bonding wires and in the PCB,
performed through e·MMC interface. Data recovery procedure the electrical path between the flash memory dies and the
typically requires the steps shown in Fig. 4. PCB can be visually observed through X-ray radiographic
inspection. Fig. 6 shows the example of the X-ray inspection
Process Tools image of an e·MMC. Notice that only dense materials such as
Identification of internal flash • X-ray
metals are visible. As Fig. 6 is taken from the top side of the
memory interface • Logic Analyzer the target e·MMC, the bonding wires are shown as thin straight
lines. By tracing the PCB trace where each bonding wire
is connected, an examiner can find through which connector
Raw data extraction from flash • Flash memory reader the flash memory is accessible. Caution must be used when
memory
using the X-ray for tracing the traces. X-ray energy can
damage the flash IC, and can affect the charging state of
Error correction, data • Custom reverse-engineering flash memory cells, potentially damaging the stored data [27],
• Commercial tools (ex. Visual NAND
unmasking, physical address Reconstructor, PC-3000 flash, Flash [28]. Therefore the path tracing of flash memory in an e·MMC
translation Extractor)
should be performed with a reference device when performing
it for forensic purposes. After tracing the physical path from
each bonding wire connected to the flash memory, the signal
• Forensic carving tools
Data carving for recovery name of each pin can be determined by monitoring each
signal with logic analyzer. A logic analyzer lets an examiner
monitor the signal bus while the target device is operating.
Fig. 4. Typical workflow of data recovery from inside an e·MMC. Required In the process of identifying the signal pins, all the non-
processes are shown here with popularly used tools. standard pins can be connected to a logic analyzer. Then, the
For analyzing an e·MMC whose structure is unknown, commands and responses between the flash memory controller
typically the procedure starts with identifying the internal and the target flash memory can be monitored. By identifying
physical structures. Once identified physically, logical signals the known command and response patterns (such as chip ID
are examined in order to connect the target device to a read), the signal name of each connector can be identified.
flash memory reader properly. After extracting the raw data Through this procedure one can find which pin is connected
through flash memory interface, an forensic examiner needs to the signal listed in Table I. Through those procedures, we
to process the physical data to correct bit-errors, unmask have identified connectors that are connected to internal flash
randomization, and re-order the data to the logical addresses. memory on e·MMCs from multiple manufacturers. Typically,
For the detailed post data processing procedures, we refer the flash memory signal pins are connected to the connector pads
readers to previous research reported in [23] and [26]. In this that are visible on the bottom side of a eMMC package.
section, we demonstrate the techniques to identify the flash The locations of flash signal pins on e·MMCs by multiple
memory interface in an e·MMC for physical data extraction. manufactures can be found below.
1) Samsung: Fig. 7a shows the bottom view of Samsung
KLMBG4GEAC. Notice that there exist multiple connectors
A. Identifying Flash Memory Signal Connectors at every corner of the package, which are not included in
The first step to access the flash memory inside an e·MMC is the ball connectors shown in Fig. 2c. By tracing the internal
to identify the traces where the signal lines of the flash memory connections of flash memory, we find that all the flash signal
dies are connected. During the e·MMC device packaging pins are connected to those non-standard connector pads.
process, the flash memory die and the flash controller die are Namely, the pads indicated in red square are connected to
connected to the printed circuit board (PCB) through bonding the signals shown in Table I. Through our experience, flash
wires, then the device is assembled as an IC device with epoxy memory in all the Samsung e·MMCs is accessible through

© 2022 IEEE. Personal use is permitted, but republication/redistribution requires IEEE [Link] [Link] for more information.
 This article has been accepted for publication in IEEE Transactions on Information Forensics and Security. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/TIFS.2022.3176187

Memory controller

Flash Memory

(a) Samsung KLMBG4GEAC bottom view

Bonding wire

Fig. 6. X-rayed image of an e·MMC. Bonding wires, traces in the PCB,

electrical components, and ball connectors are visible. The imaginary locations
of the flash controller and flash memory are illustrated.

those non-standard connectors at the corners. The location of

those non-standard connectors, along with the number, differ
by product. Therefore tracing of flash signal pins is required
every time a forensic investigator analyzes the different model
of Samsung e·MMC, along with “bus-sniffing” in order to
decide which signal pin is connected to each connector.
2) SanDisk: Fig. 7b shows the bottom view of SanDisk
SDIN7DU2. There are non-standard connectors (shown in
gold color) surrounding the standard 169-pin connectors. Flash (b) Sandisk SDIN7DU2 bottom view
memory connection can be traced to those pins, and based on
our experience, SanDisk e·MMC always follow the same flash
memory footprint. Connectors indicated with red circles are
connected to the internal flash memory.
3) Toshiba: In Toshiba e·MMCs, non-standard connectors
are typically under the coating layer, and they are only
accessible after removing the solder masks. An example pinout
is shown in Fig. 7c. Pins in red squares are connected to the
internal flash memory. One can access the flash memory by
exposing those connectors. At the same time, flash memory
in Toshiba e·MMCs are also accessible through the standard
169-pin connectors. One of the standard pins (labeled as N2 in
Fig. 2c, also indicated in blue circle in Fig. 7c) is used as the
multiplexer input, which determines whether the card operates
as an eMMC or a flash memory. If N2 pin is tied to Vss as (c) Toshiba THGBMBG7D2KBAIL bottom view
defined in [15], the card operates as an eMMC. If N2 pin is Fig. 7. e·MMC bottom views from multiple manufacturers. Non-standard
pins are exposed on Samsung and SanDisk e·MMCs.
pulled high, however, the card operates as a flash memory.
The tracing of the internal connection reveals that connectors
indicated with red circles in Fig. 7c are used for accessing the
[30], and Soft-Center Flash Extractor [31] can help examiners
flash memory. Data bus lines are shared between the e·MMC
read the target flash memory and extract the raw data from
protocol and the flash protocol on Toshiba e·MMCs.
the whole memory region.

B. Flash Memory Data Extraction

IV. E XPERIMENTS
Once the locations of all the flash memory signal pins
are identified, the internal data can be extracted by issuing To investigate the data recovery rate from raw flash inside
the correct data read commands to the memory through an e·MMC, we conducted two lab-controlled tests. First, we
identified signal connectors. Flash memory readers such as performed data recovery from Android smartphones. Second,
NFI MemoryToolKit [29], Rusolut Visual Nand Reconstructor we evaluate the effect of the e·MMC data purge operation to

© 2022 IEEE. Personal use is permitted, but republication/redistribution requires IEEE [Link] [Link] for more information.
 This article has been accepted for publication in IEEE Transactions on Information Forensics and Security. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/TIFS.2022.3176187

the internal flash memory. The detailed procedures of each test Out of 4,366,302 sectors, 920,717 blocks do not contain data
are discussed in this section. (The whole block is either all logical 0 or 1). In order to
count the correct number of sectors that remained in flash
A. Deleted Android Data Recovery memory after data purge operation, we counted the recoverable
data-containing sectors remained in flash memory. The rates of
We select Xperia Z2 as our target to perform data re-
recoverable sectors are therefore calculated against 3,445,585
covery, whose data is stored with clear-text in the storage
sectors.
media. We purchased 6 devices from the second-hand market,
within which user data still remained on the device. Sandisk
C. Testing Environment
SDIN7DP2-4G was mounted on each target device as the main
storage media. The e·MMCs were detached from the PCB In order to issue the e·MMC commands directly to the
of each device, and then we first extract the physical image target e·MMCs and control the data write and erase, we
through the e·MMC interface. Data extraction was performed developed an e·MMC programmer with Raspberry Pi using
with the command “dd” after the target e·MMC is connected to its GPIO [32]. The e·MMC programmer first initialize the
a PC through an SD/MMC card reader. Following the e·MMC target card, which is necessary to make the card ready for IO
data extraction, we proceed to extract the physical data from communication. Then the required data purge commands are
the internal flash memory by connecting the flash memory issued. For initial data image storing to the target e·MMC, we
reader to the flash interface on each e·MMC described in the used the “dd” command. For acquiring the raw flash memory
previous section. data, we used Rusolut Visual NAND Reconstructor throughout
After acquiring the raw flash data, we process the data the experiment. Figure 8 shows the connection between one
by performing error correction and data de-randomization of the target e·MMC and the flash memory reader.
to recover the original plain-text data. In order to simplify
the quantification process of the data recovery comparison,
we carved out the SMS messages from the acquired data
using the header information. The number of recovered SMS
messages are compared between the ones extracted from
e·MMC interface, and the ones extracted from the raw flash
data.

B. Data Recovery after Data Purge Operations

As discussed in Section II-D, multiple data purge operations
Fig. 8. Connection between the flash memory interface of a target eMMC and
are defined in e·MMC specifications. In order to investigate the flash memory reader. The flash memory reader sends the read command
the impact of erasing on the e·MMC interface to the physical to the whole data area of the target flash memory.
data, we copied the same physical e·MMC image to multiple
e·MMCs from various manufacturers, and then performed data
V. R ESULTS
purge operation through e·MMC interface. Table II shows
the list of e·MMCs used for the test. We selected Samsung, A. Deleted Android Data Recovery
SanDisk, and Toshiba devices since we most often encounter Table III shows the overall counts of recovered SMS mes-
those manufacturers’ e·MMCs in our casework. Each target sages both from the e·MMC image and from the internal
e·MMC was labeled with the number shown in Table II. We flash memory data. Here, the eMMC data is equivalent to
use those numbers to refer each target for the rest of this paper. the physical data described in section I. The number of
4GB of Android image data was used as the original data. SMS messages retrieved from e·MMC thus already includes
The data was extracted from one of the phones used for the logically deleted data. If the traditional physical acquisition
experiment described in section IV-A. The image data includes was performed and data is acquired through e·MMC interface,
27 partitions, within which the userdata partition has the the numbers listed under SMS count on e·MMC in Table III
largest volume of 2.1GB. After confirming that data copy was is the maximum number of messages that can be recovered.
successful, we issued data purge commands against userdata Comparing it with the number shown in SMS count on flash,
partition, followed by raw flash memory data extraction. We it is clear that traditional physical data acquisition through
performed Secure Erase, Secure Trim, and Sanitize combined e·MMC interface is still missing recoverable data remaining in
with Trim, to evaluate the impact of each operation. the internal flash memory. More message data is still available
For each test, we compared the raw data extracted through on the flash memory than what can be carved out from the
the flash memory interface with the original userdata partition e·MMC. Note that those messages that are not available on
data stored in the e·MMC. The comparison was carried out the e·MMC is not accessible from the host system. Those
by each sector. To observe the accurate rate of possible data messages extracted from the raw flash data therefore contain
recovery, the number of sectors whose data still remain on the the ones deleted by the user or by the system, and cache data
raw flash memory was counted. The physical sector address of created by the internal flash memory controller [33].
the userdata partition in the e·MMC is between 0x31E000 and Actual user data recovery rate depends on how each applica-
0x747FDE, which consists of 4,366,302 512-byte long sectors. tion software and the operating system of the device take care

© 2022 IEEE. Personal use is permitted, but republication/redistribution requires IEEE [Link] [Link] for more information.
 This article has been accepted for publication in IEEE Transactions on Information Forensics and Security. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/TIFS.2022.3176187

TABLE II
L IST OF TARGET e·MMC S

Number Manufacturer Part Number Size (GB) eMMC version

1 Samsung KLM8G2FEJA-A001 8 4.41
2 Samsung KLM8G1WEMB-A001 8 4.5
3 Toshiba THGBM5G7B2JBA1M 16 4.5
4 SanDisk SDIN7DU2-16G 16 4.41
5 SanDisk SDIN8DE4-16G 16 4.5

TABLE III most secure data purge operation, most of the data remains
SMS DATA RECOVERY FROM E MMC AND THE INTERNAL FLASH MEMORY in flash memory in the target e·MMC 2 and 3. On the other
Target SMS count on eMMC SMS Count on flash hand, if the Secure Erase is strictly implemented, majority of
A 41 116 the data is wiped from the internal flash memory as can be
B 19 47 seen from the result of target e·MMC 1, 4, and 5. For those
C 20 105
D 4,723 4,866
devices, if data purge operation was performed from the host
E 82 118 system, chances of recovering deleted data are significantly
F 1,174 1,540 low even if the data is extracted from internal flash memory.
During the data purge operation, we also monitored the
operation time by observing the “busy” signal returned from
of the deleting operation. Therefore it is not feasible to directly the e·MMC during the operation. After receiving the Erase
extrapolate the userdata recovery rate from this experiment. command, the e·MMC returns a response and pulls D0 line
However it is obvious that more data can be recovered if the low while performing the operation. We observed that target
internal flash data is explored than what is extracted through e·MMC 1 and 3 take longer erase operation time than other
eMMC interface. For target devices A, B, and C, more than devices. However, the operation time and data recovery rate
twice of user data is recovered from the internal memory. This do not correlate since even after long operation time of target
result shows that the chance of finding deleted data can be 3, majority of data is still recoverable.
increased by accessing the internal flash memory of an eMMC.
VI. D ISCUSSION
B. Data Recovery after Data Purge Operations
Through our experiments, it is now obvious that securely
Given the results of data recovery rate from e·MMCs used erased data can still be recovered from the internal flash
in real Android devices, it is safe to assume that good amount memory in some e·MMC models. Given the large volume
of data still remains in the internal flash memory. Now we of different e·MMC models on the market manufactured by
evaluate data recovery rate after different data purge operation multiple manufacturers, it should be however noted that more
is performed on the e·MMC. Through e·MMC interface, we intensive testing with much larger scale is required to build a
performed Secure Erase, Secure Trim, and Sanitize against comprehensive data recovery rate of securely erased e·MMCs.
the userdata partition at e·MMC address between 0x31E000 Different chip model contains different flash controller ar-
and 0x747FDE. Viewing the physical data through e·MMC chitecture, therefore internal flash memory data is treated
interface showed us that the whole partition was overwritten differently. Nevertheless, extracting raw data from e·MMCs
with logical 0s after erasure. Therefore no user data can can still be effective when thorough investigation is necessary.
be recovered from physical data acquired through e·MMC In this section, we discuss how our results can be interpreted in
interface if any of the purge operation were performed against digital forensic domain, as well as other environmental factors
the userdata partition. This means that, if any of the purge that can affect the data recovery rate.
operation is performed on an Android device used in the
previous section, the number shown in as SMS count in
e·MMC in Table III becomes 0. A. Forensic interpretation and application
After performing data purge operation to the userdata par- In [34] and [35], ioctl(BLKSECDISCARD) is recommended
tition, raw flash memory data was extracted through identified as the best practice for data sanitization process in Android
flash interface. Data recovery rate from internal flash memory factory reset. This operation issues one of the data purge
after each data purge operation is shown in Table IV. Here, the commands that are used in our experiment: Secure Erase (or
number of recoverable sectors through flash memory interface Secure Trim) or Trim combined with Sanitize, depending on
is listed. Recovery rate is calculated against the total number the target e·MMC version. While each operation makes the
of original data-containing sectors, which is 3,445,585 sectors. erased data inaccessible through the e·MMC interface, as we
As shown in Table IV, almost all the securely erased data have shown through our experiment, there is a great chance
still remains on the target e·MMC 2 and 3, from which the that most of the original data still remains in the underlying
original userdata partition data can be recovered. Despite the flash memory. Note that the flash controller is allowed to
difference of definition in Secure erase, Secure Trim, and perform data erasure at its convenient timing for some of
Sanitize, the behavior of those data purge operation showed the erase commands. In [14], it is defined that “Erase” and
the similar results. Even after Sanitize command, which is the “Trim” commands allow controllers to perform the erase at its

© 2022 IEEE. Personal use is permitted, but republication/redistribution requires IEEE [Link] [Link] for more information.
 This article has been accepted for publication in IEEE Transactions on Information Forensics and Security. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/TIFS.2022.3176187

TABLE IV
R ECOVERABLE S ECTORS AFTER E RASE O PERATIONS

Number of Recoverable Sectors after Different Erase Operations (Rate(%))

Target IC Secure Erase Secure Trim Sanitize
1 935 (<0.001 %) 926 (<0.001 %) NA (operation not supported)
2 3,425,560 (99.41 %) 3,425,032 (99.40 %) 3,424,652 (99.42 %)
3 3,444,362 (99.96 %) 3,444,223 (99.96 %) 3,444,424 (99.97 %)
4 126,033 (3.66 %) 125,966 (3.66 %) NA (operation not supported)
5 13,376 (0.0039 %) 11,376 (0.0033 %) 10,231 (0.0030 %)

convenient timing. In case the flash memory controllers in our choice but erase the old data remained in the flash memory.
target e·MMCs are configured to perform the actual erase at a When this is the case, the recovery rate of erased data can
system down time, we left the target e·MMCs powered on after be low. In order to prove this hypothesis, we overwrite all
data erasure operation with the clock signals on. However, the blocks of the target eMMCs with logical 0s. Post data
even after waiting for over an hour and repeating power cycles, extraction from flash memory shows that only fractions of
the data recovery rate was unchanged. Additionally, in [12], it old data (less than 0.1%) remains on the flash memory after
is proposed to execute Trim/Discard operation as a background overwriting all the blocks.
operation in order to reduce latencies during device operation. 2) Encryption: If the original data is encrypted when it is
Therefore we also send the command to manually start the stored on an e·MMC, the data is also stored in the flash mem-
background operations on the target e·MMCs. However the ory in an encrypted form. Therefore, even if the original data
results remain unchanged. Based on those observations, we can be reconstructed from the data remained in flash memory,
conclude that all the data erasure operations are completed data decryption procedures are required. This operation may
at the time we performed the data recovery, and no more be challenging unless the whole data partition can be recovered
data deletion will be performed at a later timing on the target error-free, and decryption method is established.
devices. While our approach proposed in this paper is appli- 3) Data fragmentation: In our experiments, the whole
cable to all the devices in which e·MMC is mounted, forensic image was copied to the target e·MMC right before the data
examiners need to consider applying the method depending on erasure was performed. In a real digital device, however, data
its requirements and prioritization. Given its intense reverse- write and erase operations are constantly performed to the
engineering in both hardware and software, the operation is e·MMC. Every time the existing file is updated, new data
time-consuming. Furthermore, details of the e·MMC controller is written into a new physical address, leaving the old data
operation are proprietary to the manufacturers, and they vary in the existing location. As a result, fragmented data can
by the models. With backlog being a commonplace at digital be found in multiple locations within flash memory. While
forensics labs [36], [37], examiners need to carefully select it may be hard to recover the complete files from those
the target eMMCs on which raw flash memory extraction fragments, investigators may find some meaningful data (such
to perform. There is also a great chance that the data is as metadata) from those locations.
already destroyed at physical level if data purge operation
is implemented strictly by the manufacturer. As discussed in
section I and section V, recovery of deleted data is possible VII. R ELATED W ORK
to some extent through file system extraction and physical To our knowledge, this is the first work to investigate the
extraction, which is performed through e·MMC interface. If data recovery rate of e·MMCs after their data is securely
the target data is still missing after examining the extracted erased. This work can be regarded as the complimentary to
data through those method, then the physical data extraction the previous works by [9] and [26], which demonstrate the
from the internal memory of e·MMCs should be considered thorough data recovery procedures from flash memory. In their
as a next step. research, the authors explained how to extract and reconstruct
the user data from raw flash memory mounted on digital
B. Other factors effecting data recovery rate devices. Since flash memory is now embedded inside the
While the experimental data recovery rate is promising, e·MMC and other managed flash, our approach is required
various environmental factors needs to be considered when in addition to the techniques described in their work.
attempting data recovery from e·MMCs mounted on digital The possibility of privacy data leakage is discussed in
devices. The actual operating environment may greatly affect [33] and [38]. Data management in programming and erasing
the data recovery rate. Some of the operational factors include operation to flash memory apparently leaves valid data in
the following: unmapped memory block, leading possible data leakage when
1) Available Physical Space in the Flash Memory: Imagine accessed by advisaries. The problem pointed out in those
a case where the eMMC in a target device is almost full, and works have been already explored with SSDs in [39]. In
there is not much space for a large file to be stored. In order their work, authors also report that some SSD manufacturers
to store some new data, the user need to discard some of implement secure erasing features incorrectly, leaving erased
the existing files. When storing a new file, since there is not data on flash memory in a way that can be recoverable by
much space left at the physical level, the flash controller has no adversaries.

© 2022 IEEE. Personal use is permitted, but republication/redistribution requires IEEE [Link] [Link] for more information.
 This article has been accepted for publication in IEEE Transactions on Information Forensics and Security. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/TIFS.2022.3176187

10

Additionally, the poor data sanitization practice of flash [9] M. Breeuwsma, M. de Jongh M, C. Klaver, R. van der Knijff, and
and e·MMC based devices in the IC recycling ecosystem M. Roeloffs, “Forensics Data Recovery from Flash Memory,” Small
Scale Digital Device Forensics Journal, 2007.
is reported in [40]. The authors claim that old data which [10] M. Kumar, “Mobile forensics: Tools, techniques and approach,” in Crime
belonged to the previous device still remains after the target Science and Digital Forensics: A Holistic View. CRC Press, 2021, pp.
chip is re-implemented into a new device. While old data was 102–116.
[11] G. Gendy. (2017) Mastering emmc device programming how to maxi-
recovered from second-hand e·MMCs through this research, mize speed, quality and cost savings.
the authors did not investigate inside the e·MMC. Given that [12] B. Kim, D. H. Kang, C. Min, and Y. I. Eom, “Understanding implications
no proper data purge operation was performed on the e·MMCs of trim, discard, and background command for emmc storage device,” in
2014 IEEE 3rd Global Conference on Consumer Electronics (GCCE),
before being recycled into new devices, we assume that more 2014, pp. 709–710.
data than reported in [40] can be recoverable by following our [13] Embedded MultiMediaCard (e·MMC) e·MMC/Card Product Standard,
approaches. High Capacity, including Reliable Write, Boot, Sleep Modes, Dual
Data Rate, Multiple Partitions Supports, Security Enhancement,
Background Operation and High Priority Interrupt (MMCA,
VIII. C ONCLUSION AND F UTURE W ORK 4.41), JEDEC Solid State Technology Association JEDEC
Standard JESD84-A441, March 2010. [Online]. Available:
We have shown that securely erased data on e·MMCs can [Link]
still be recoverable by directly extracting data from the internal [14] Embedded Multi-Media Card (e·MMC) Electrical Standard
flash memory. As flash memory and the flash memory con- (5.1), JEDEC Solid State Technology Association JEDEC
Standard JESD84-B51, February 2015. [Online]. Available:
troller are embedded in one package in the e·MMC, extracting [Link]
the flash memory data and processing it into error-free clear- [15] Embedded MultiMediaCard (eMMC) Mechanical Standard,
text require intensive investigation of the target. Nevertheless, JEDEC Solid State Technology Association JEDEC
Standard JESD84-C43, June 2007. [Online]. Available:
as we have shown in section III, data can be extracted without [Link]
damaging the physical structure and function of the target [16] Samdunk emmc backdoor leading to bootloader unlock
e·MMC. While secure data purge operation on e·MMCs makes on samsung galaxy devices. [Online]. Available:
[Link] 1.0-
forensic data recovery challenging, our powerful data recovery [Link]
methods can improve the efficiency of data recovery tasks at [17] J. Boukhobza and P. Olivier, “7 - flash translation layer,”
digital forensics labs. As discussed in section VI, the possible in Flash Memory Integration, J. Boukhobza and P. Olivier,
Eds. Elsevier, 2017, pp. 129–147. [Online]. Available:
target device may also include factory reset Android devices. [Link]
Even if the secure purge operation was performed on the [18] C. Zambelli, M. Indaco, M. Fabiano, S. Di Carlo, P. Prinetto, P. Olivo,
target system, there is a great chance that deleted data can and D. Bertozzi, “A cross-layer approach for new reliability-performance
trade-offs in mlc nand flash memories,” in Proceedings of the Conference
still be recovered from flash memory inside the e·MMCs on Design, Automation and Test in Europe, ser. DATE ’12. San Jose,
mounted on modern digital devices. Since the underlining CA, USA: EDA Consortium, 2012, p. 881–886.
flash memory technology remains unchanged even in more [19] Y. Cai, E. F. Haratsch, O. Mutlu, and K. Mai, “Error patterns in mlc
nand flash memory: Measurement, characterization, and analysis,” in
advanced managed flash memory such as UFS, we assume 2012 Design, Automation Test in Europe Conference Exhibition (DATE),
that similar outcome can be observed in other managed flash 2012, pp. 521–526.
memory devices. Those advanced managed flash memory can [20] J. Cha and S. Kang, “Data Randomization Scheme for Endurance
Enhancement and Interference Mitigation of Multilevel Flash Memory
be a good candidate as the future target for further analyzing Devices,” ETRI Journal, 2013.
the internal structure for forensic purposes. [21] Q. Xiong, F. Wu, Z. Lu, Y. Zhu, Y. Zhou, Y. Chu, C. Xie, and P. Huang,
“Characterizing 3d floating gate nand flash,” in Proceedings of the
R EFERENCES 2017 ACM SIGMETRICS / International Conference on Measurement
and Modeling of Computer Systems, ser. SIGMETRICS ’17 Abstracts.
[1] I. Pooters, “Full user data acquisition from symbian smart phones,” New York, NY, USA: Association for Computing Machinery, 2017, p.
Digital Investigation, vol. 6, no. 3-4, pp. 125–135, 2010. 31–32. [Online]. Available: [Link]
[2] G. Grispos, T. Storer, and W. B. Glisson, “A comparison of forensic [22] A. Fukami, S. Ghose, Y. Luo, Y. Cai, and O. Mutlu, “Improving the
evidence recovery techniques for a windows mobile smart phone,” reliability of chip-off forensic analysis of nand flash memory devices,”
Digital Investigation, vol. 8, no. 1, pp. 23–36, 2011. [Online]. Available: Digital Investigation, vol. 20, pp. S1 – S11, 2017. [Online]. Available:
[Link] [Link]
[3] C. Racioppo and N. Murthy, “Android forensics: A case study of the [23] J. P. van Zandwijk, “A Mathematical Approach to NAND Flash-Memory
“HTC incredible” phone,” in Proceedings of Student-Faculty Research Descrambling and Decoding,” Digital Investigation, 2015.
Day, Pace University, 2012, pp. B6.1–B6.8. [24] (2021) Open nand flash interface specification. [Online]. Available:
[4] C. M. da Silveira, R. T. de Sousa Jr, R. de Oliveira Albuquerque, G. D. [Link]
Amvame Nze, G. A. de Oliveira Júnior, A. L. Sandoval Orozco, and [25] V. Tsai. (2011) e·mmc v4.41 and v4.5 architecture for
L. J. Garcı́a Villalba, “Methodology for forensics data reconstruction high speed functions and features. [Online]. Available:
on mobile devices with android operating system applying in- [Link] Tsai(1).pdf
system programming and combination firmware,” Applied Sciences, [26] I. Sestanj, NAND Flash Data Recovery Cookbook, 06 2016.
vol. 10, no. 12, 2020. [Online]. Available: [Link] [27] I. T. AG, “X-ray inspection considerations for surface-mounted flash
3417/10/12/4231 ics,” 81726 Munich, Germany, Tech. Rep. 001-98522 Rev. C, 2021.
[5] J. Lessard and G. C. Kessler, “Android forensics: Simplifying cell phone [28] H. Dogan, M. Md, N. Asadizanjani, S. Shahbazmohamadi, D. Forte,
examinations,” 2010. and M. Tehranipoor, “Analyzing the impact of x-ray tomography on the
[6] NIST, “Mobile Device Forensic Tool Specification, Test Assertions and reliability of integrated circuits,” 11 2015.
Test Cases Version 3.1,” 2021. [29] N. F. Institute. Nfi memory toolkit. [Online]. Avail-
[7] A. Hoog, “Chapter 6 - android forensic techniques,” in Android Foren- able: [Link]
sics, A. Hoog, Ed. Boston: Syngress, 2011, pp. 195–284. products/nfi-memory-toolkit
[8] T. Almehmadi and O. Batarfi, “Impact of android phone rooting on user [30] ruSolut. Visual nand reconstructor 5.0. [Online]. Available:
data integrity in mobile forensics,” in 2019 2nd International Conference [Link]
on Computer Applications Information Security (ICCAIS), 2019, pp. 1– [31] Soft-Center. Flash extractor. [Online]. Available: [Link]
6. [Link]/

© 2022 IEEE. Personal use is permitted, but republication/redistribution requires IEEE [Link] [Link] for more information.
 This article has been accepted for publication in IEEE Transactions on Information Forensics and Security. This is the author's version which has not been fully edited and
content may change prior to final publication. Citation information: DOI 10.1109/TIFS.2022.3176187

11

[32] Raspberry Pi Foundation. Raspberry pi 3 model b. [Online]. Available: art and the future potential of artificial intelligence in digital
[Link] forensic investigation,” ser. ARES ’20. New York, NY, USA:
[33] N. Y. Ahn and D. H. Lee, “Forensics and anti-forensics of a nand flash Association for Computing Machinery, 2020. [Online]. Available:
memory: From a copy-back program perspective,” IEEE Access, vol. 9, [Link]
pp. 14 130–14 137, 2021. [38] N.-Y. Ahn and D. H. Lee, “Schemes for privacy data destruction in a
[34] L. Simon and R. Anderson, “A security analysis of android factory nand flash memory,” IEEE Access, vol. 7, pp. 181 305–181 313, 2019.
resets,” in MOBILE SECURITY TECHNOLOGIES (MOST) 2015, 2015.
[35] Android Open Source Project. (2020) Secure an android device. [39] M. Wei, L. M. Grupp, F. E. Spada, and S. Swanson, “Reliably erasing
[Online]. Available: [Link] data from flash-based solid state drives,” in Proceedings of the 9th
[36] R. Montasari and R. Hill, “Next-generation digital forensics: Challenges USENIX Conference on File and Stroage Technologies, ser. FAST’11.
and future paradigms,” in 2019 IEEE 12th International Conference on USA: USENIX Association, 2011, p. 8.
Global Security, Safety and Sustainability (ICGS3), 2019, pp. 205–212. [40] J. Schneider, I. Lautner, D. Moussa, J. Wolf, N. Scheler, F. Freiling,
[37] X. Du, C. Hargreaves, J. Sheppard, F. Anda, A. Sayakkara, N.- J. Haasnoot, H. Henseler, S. Malik, H. Morgenstern, and M. Westman,
A. Le-Khac, and M. Scanlon, “Sok: Exploring the state of the in Digital Forensics Research Conference Europe (DFRWS EU), 2020.

© 2022 IEEE. Personal use is permitted, but republication/redistribution requires IEEE [Link] [Link] for more information.