A mathematical approach to NAND flash-memory descrambling and decoding. (March 2015)

• Record Type: Journal Article
• Authors: van Zandwijk, Jan Peter
• Is Part Of: Digital investigation. Volume 12(2015)
• Page Start: 41
• Page End: 52
• Publication Date: 2015-03
• Subjects: NAND flash memory -- LFSR-based scrambling -- Berlekamp–Massey algorithm -- Error-correcting code -- BCH-code; Forensic sciences -- Data processing -- Periodicals; Criminal investigation -- Data processing -- Periodicals; 363.250285
• DOI: 10.1016/j.diin.2015.01.003
• Languages: English
• ISSNs: 1742-2876

Abstract

Abstract: New mathematical techniques for analysis of raw dumps of NAND flash memory were developed. These techniques are aimed at detecting, by analysis of the raw NAND flash dump only, the use of LFSR-based scrambling and the use of a binary cyclic code for error-correction. If detected, parameter values for both LFSR and cyclic error-correcting code are determined simultaneously. These can subsequently be applied to expose the content of memory pages in the raw NAND flash dump and prepare these for further processing with media analysis tools. The techniques were tested on raw NAND flash memory dumps of four different devices and in all cases LFSR-based scrambling and binary cyclic error-correcting codes were in use.