improving the reliability of chip-off forensic analysis of nand … · 2019-05-30 · improving the...
TRANSCRIPT
![Page 1: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/1.jpg)
Improving the Reliability of Chip-Off Forensic Analysis
of NAND Flash Memory Devices
Aya Fukami, Saugata Ghose, Yixin Luo, Yu Cai, Onur Mutlu
1
![Page 2: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/2.jpg)
Example Target Devices for Chip-OffAnalysis
2
No way to boot those devices: investigators turn to chip-off forensic analysis
Fire damaged cell phone
Water damaged smartphone
![Page 3: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/3.jpg)
Chip-Off Forensic Procedure
Photo courtesy: “Chip-Off BlackBerry Bold 9780” http://www.forensicswiki.org/wiki/Chip-Off_BlackBerry_Bold_9780
3
Target flashmemory IC
Heat gun
![Page 4: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/4.jpg)
Recovered Data after Chip-Off
4
Uncorrectable errors remain in recovered data when raw data is acquired through chip-off procedure
![Page 5: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/5.jpg)
Brief Summary of the Paper• Our Goal:
• Identify error sources in NAND flash memory during chip-off
• Quantify errors in NAND flash memory introduced in chip-off
• Identify a mitigation process to reduce errors introducedduring chip-off analysis
• Our findings:
• Long storage time of devices increases errors in NAND flashmemory
• Heat in chip-off increases uncorrectable errors
• Read-retry mechanism can reduce errors introduced duringchip-off
5
![Page 6: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/6.jpg)
Talk Outline
• Background• Basic operation of NAND flash memory
• Testing Methodology and Experimental Results• Retention error
• Errors introduced by heat
• How to Improve Reliability of Chip-off Analysis• Read-retry operation
6
![Page 7: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/7.jpg)
Talk Outline
7
• Background• Basic operation of NAND flash memory
• Testing Methodology and Experimental Results• Retention error
• Errors introduced by heat
• How to Improve Reliability of Chip-off Analysis• Read-retry operation
![Page 8: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/8.jpg)
MLC NAND Flash Memory Cell Operation
8
Current[A]
Voltage[V]
Amount of charge = Threshold voltage of the cell = Stored data value
Stored data: 11 Threshold voltage
SubstrateDrainSource
ControlGate
FloatingGate
Oxide
–– ––
––
– –– –
– –
– –
–
–
–
–
–
– –
– –
–
–
–
–
–
– –
– –
–
–
–
–
01 00 10
![Page 9: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/9.jpg)
MLC NAND Cell Vth Distribution
11 01 00 10
Threshold Voltage
Nu
mb
er
of
cells
Read voltage
9
Threshold voltages need to be between each read voltage
![Page 10: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/10.jpg)
Retention Error on MLC NAND Flash Cell
11 01 00 10
Threshold Voltage
Nu
mb
er o
f ce
lls
10
• Charge leakage over time causes threshold voltage shifts • Data error in result is called retention error
–
–
–
– –
–
–
–
–
SubstrateDrainSource
ControlGate
FloatingGate
Oxide
–– ––
––
– –– –
–
–
– –
–
–
–
–
–
–
–
–
–
–
–
–
–
Error! Error! Error!
Read voltage
![Page 11: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/11.jpg)
NAND Flash Cell Degradation
11
Repeated programming and erasing (P/E cycle) accelerates charge leakage
–
– –
–
–
–
–
–
–
00
Threshold Voltage
Nu
mb
er o
f ce
lls
10 → 00
–
–
–
ErasingProgramming
10
Oxide
Degraded Cell
–
–
–
–
–
–
–
–
–
–
–
–
–
– –
![Page 12: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/12.jpg)
NAND Flash Error Sources During Chip-off
• Heat guns or electrical rework machines• De-solder NAND flash memory chips with heat
• Required temperature and duration: 250 °C (482 °F), ~2 minutes
12
High temperature accelerates charge leakage
![Page 13: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/13.jpg)
Error Correction Codes (ECC)
• Flash memory controllers store ECCcodewords to correct errors in data
• Typical correction capability for recent chip:40 bits correction capability per 1KB
• Errors exceeding ECC correction capability:uncorrectable errors
13
![Page 14: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/14.jpg)
Talk Outline
14
• Background• Basic operation of NAND flash memory
• Testing Methodology and Experimental Results• Retention error
• Errors introduced by heat
• How to Improve Reliability of Chip-off Analysis• Read-retry operation
![Page 15: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/15.jpg)
Testing Environment
• Test chips: New 2y-nm NAND flash memory chips fromtwo different vendors (hereafter called Chip A and Chip B)
• Controller: Altera DE0 FPGA
15
![Page 16: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/16.jpg)
Testing Methodology:
Retention Error Evaluation
• Repeated programming/erasing cycles(P/E cycles)• 10, 300, 1000, 2500, and 4000 cycles
• Raw bit error rate (RBER) measurementat multiple retention age (=wait timeafter programming) • Day 0 and 1, Week 1, 2, 3 and 4
16
![Page 17: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/17.jpg)
Experimental Result:
Retention Error: Chip A
17
ECC Error Correction Capability
10 100 1K
Day 0Day 1Week 1Week 4
P/E Cycle Count
Raw
Bit
Erro
r Rate
10-2
10-3
10-4
10-5
RBER grows as P/E cycle count and retention age increase
12×18×
![Page 18: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/18.jpg)
Experimental Result:
Retention Error: Chip B
18
ECC Error Correction Capability
10 100 1K
Day 0Day 1Week 1Week 4
P/E Cycle Count
Raw
B
it
Erro
r R
ate
10-2
10-3
10-4
10-5
RBER grows as P/E cycle count and retention age increase
3×4×
![Page 19: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/19.jpg)
Testing Methodology:
Thermal Effect Evaluation
• Baking target chips at 250 °C for 2 mins atdifferent retention age (simulating chip-offprocedures)• 1 Week
• 4 Weeks
• Raw bit error rate (RBER) measurement afterbaking
19
![Page 20: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/20.jpg)
Experimental Result:
Errors Introduced by Heat (Chip A)
20
ECC Error CorrectionCapability
10 100 1K
Week 1, Before Baking
Week 4, Before Baking
Week 1, After Baking
Week 4, After Baking
P/E Cycle Count
Raw
B
it
Erro
r R
ate
100
10-1
10-2
10-3
10-4
10-5
33×51×
Heat introduces errors more than ECC can correct
![Page 21: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/21.jpg)
Experimental Result:
Errors Introduced by Heat (Chip B)
21
10 100 1K
Week 1, Before Bak-ingWeek 4, Before Bak-ingWeek 1, After Bak-ing
P/E Cycle Count
Raw
Bit
Err
or
Rat
e100
10-1
10-2
10-3
10-4
10-5
37×
51x
ECC Error Correction Capability
Heat introduces errors more than ECC can correct
![Page 22: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/22.jpg)
Experimental Result:
Uncorrectable Errors after Baking
RetentionPeriod before
Baking
Chip A Chip B
1 Week 29.1% 78.1%
4 Weeks 84.2% 83.6%
22
Fraction of pages that contains uncorrectable errors (P/E cycle=300)
Heat introduces uncorrectable errors even when the chip has been only lightly used
![Page 23: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/23.jpg)
Talk Outline
23
• Background• Basic operation of NAND flash memory
• Testing Methodology and Experimental Results• Retention error
• Errors introduced by heat
• How to Improve Reliability of Chip-off Analysis• Read-retry operation
![Page 24: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/24.jpg)
Read-Retry Mechanism
24
11
Threshold Voltage
Nu
mb
er o
f ce
lls
01 → 11
Default read voltage
Shifted read voltage
Shifted read voltage
01 → 11
Read-retry mechanism shifts the read voltage to reduce errors caused by threshold voltage shifts
01
![Page 25: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/25.jpg)
Testing Methodology:
Read-Retry Evaluation
• Read-Retry command found on chip B• Implemented as a vendor specific command
• Read operation with read-retry• Evaluation of 2 modes (mode A and B)
25
![Page 26: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/26.jpg)
Experimental Result:
Error Reduction with Read-Retry
26
10 100 1K
Default Read
Read-Retry Mode A
Read-Retry Mode B
P/E Cycle Count
Raw
Bit
Err
or
Rate
(4 weeks after programming)
10-1
10-2
10-3
10-4
ECC Error CorrectionCapability -88.6%
-94.6%
![Page 27: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/27.jpg)
Uncorrectable Error Reduction by Read-Retry
27
Read ModeP/E Cycle Count
300 1000
Default 83.6% 99.7%
Read-Retry A 0% 12.1%
Read-Retry B 0% 0%
Read-retry can reduce errors introducedby thermal-based chip-off procedure
Fraction of pages that contains uncorrectable errors (Chip B, after baking)
![Page 28: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/28.jpg)
Conclusions andRecommendations•Wait time increases errors• Conduct data extraction at the earliest possible time
after receiving a device
• Heat introduces uncorrectable errors• Keep the temperature as low as possible
• Read-retry can reduce errors• Use read-retry after chip-off when available
28
![Page 29: Improving the Reliability of Chip-Off Forensic Analysis of NAND … · 2019-05-30 · Improving the Reliability of Chip-Off Forensic Analysis of NAND Flash Memory Devices Aya Fukamia,b,](https://reader033.vdocument.in/reader033/viewer/2022041521/5e2e6429e14e68716c2fb996/html5/thumbnails/29.jpg)
Improving the Reliability of Chip-Off Forensic Analysis
of NAND Flash Memory Devices
Aya Fukamia,b, Saugata Ghoseb, Yixin Luob, Yu Caib, Onur Mutlub,c
aNational Police Agency of Japan, bCarnegie Mellon University, cETH Zurich
29