A forensic analysis of the Google Home: repairing compressed data without error correction. (October 2022)

• Record Type: Journal Article
• Authors: Barral, Hadrien; Jaloyan, Georges-Axel; Thomas-Brans, Fabien; Regnery, Matthieu; Géraud-Stewart, Rémi; Heckmann, Thibaut; Souvignet, Thomas; Naccache, David
• Is Part Of: Forensic science international. Volume 42/43(2022)
• Publication Date: 2022-10
• Subjects: Google home -- SquashFS -- Gzip -- Data extraction -- Data repair
• DOI: 10.1016/j.fsidi.2022.301437
• Languages: English
• ISSNs: 2666-2817

Abstract

Abstract: This paper provides a detailed explanation of the steps taken to extract and repair a Google Home's internal data. Starting with reverse engineering the hardware of a commercial off-the-shelf Google Home, internal data is then extracted by desoldering and dumping the flash memory. As error correction is performed by the CPU using an undisclosed method, a new alternative method is shown to repair a corrupted SquashFS filesystem, under the assumption of a single or double bitflip per gzip-compressed fragment. Finally, a new method to handle multiple possible repairs using three-valued logic is presented. Highlights: Smart speakers like Google Home have many active components, some of which contain data. Error correction is performed using undisclosed methods, which are not available to forensics investigators. Extracted data presents minor errors, resulting in compressed data being corrupted. It is possible, under the assumption of few errors, to repair the corrupted data by exploiting other sources of redundancy. Imprecision of the repair process can be measured using three-valued logic.