Embedded Systems Forensics

Embedded Devices as a Forensic Evidence Source

Embedded systems occupy a forensic blind spot that conventional digital forensics workflows are not equipped to address. A laptop running Windows or macOS presents a familiar filesystem with well-documented artifact locations. A smartphone running iOS or Android is handled by mature extraction platforms with broad device coverage. But the smart thermostat that logs occupancy patterns, the IP camera that captured video during a critical event, the industrial controller that recorded process states before equipment failure, the drone that tracked a flight path, or the smart plug that recorded power usage data: these devices run specialized operating systems on proprietary hardware with no standard forensic interface.

Accessing the data stored in embedded devices requires a fundamentally different skill set: electronics knowledge to identify memory components and debug interfaces, hardware manipulation skills to safely desolder memory chips or probe circuit board test points, embedded operating system knowledge to interpret the filesystems and data structures that forensic tools designed for standard operating systems cannot parse, and binary analysis capability to decode data stored in proprietary formats or protected by encryption.

Embedded systems forensics at GDF addresses this challenge with a combination of hardware laboratory capability and software analysis expertise. The practice covers the full spectrum of embedded device types encountered in litigation, incident response, and corporate matters, from consumer IoT products through industrial control system components. For matters involving the integrated circuits within embedded devices, GDF's IC forensics practice provides the hardware-level analysis that complements embedded systems forensics. For automotive embedded systems, the automobile ECU forensics practice extends these capabilities with vehicle-specific tools and standards.

Chip-Off Extraction

Chip-off extraction is the foundational hardware technique for embedded systems forensics when software-based approaches are not available. The process physically removes the non-volatile memory chip from the device's circuit board, interfaces it directly with a compatible flash programmer, and reads the raw memory contents into a forensic image file. This approach bypasses any software-level access controls, encryption implemented at the application layer, or device lockout mechanisms that prevent normal operation.

Memory Types and Chip-Off Coverage

GDF's chip-off laboratory handles the range of non-volatile memory types used in embedded devices:

• NAND flash: The most common storage type in IoT devices, smartphones, and embedded systems with storage requirements above a few megabytes. NAND flash comes in SLC, MLC, TLC, and QLC cell configurations with varying reliability and storage density. GDF's flash programmer library covers the major NAND vendors (Samsung, Micron, Toshiba, Western Digital) and their proprietary controller interfaces
• NOR flash: Used for firmware storage in microcontroller-based devices, industrial equipment, and automotive ECUs. NOR flash provides byte-addressable read access and is typically read in-system via JTAG or through the chip-off process when JTAG is unavailable
• eMMC (embedded MultiMediaCard): The storage format used in Android smartphones, smart TVs, set-top boxes, and many embedded systems. eMMC packages a NAND controller and memory in a BGA package soldered to the device board. GDF's eMMC extraction supports reballing (converting BGA to socket for insertion into flash programmers) and direct BGA programming
• UFS (Universal Flash Storage): The higher-performance storage standard replacing eMMC in premium smartphones and embedded applications
• EEPROM: Small-capacity non-volatile memory used for configuration storage, credential storage, and logging in microcontroller-based devices. Often contains the most forensically significant data despite its small size

Chip-Off Procedure and Chain of Custody

Chip-off is a destructive procedure that permanently alters the device by removing a component. GDF treats this irreversibility seriously. Before any chip-off extraction, the device is fully documented through photography, the decision to proceed with chip-off is documented with the requesting attorney's or client's authorization, and all available non-destructive analysis is completed. GDF removes the chip using hot air rework stations or infrared reflow systems that minimize thermal stress to adjacent components and the memory die. A post-removal photograph documents the board state and the removed component.

The extracted chip is programmed using a compatible flash programmer with the appropriate adapter for the chip package. Raw memory contents are read into a binary image file, and a SHA-256 hash is generated immediately on extraction completion. A second read verifies consistency. Both hash values are documented in the chain of custody record. If the two reads produce inconsistent results indicating read errors, GDF documents the affected memory regions and proceeds with analysis of the reliable portions while noting the limitations in the expert report.

JTAG and UART Interface Access

JTAG (IEEE 1149.1) and UART (universal asynchronous receiver-transmitter) interfaces are the primary non-destructive alternatives to chip-off for accessing embedded device memory. These interfaces are designed for manufacturing test and device debugging, not for user-facing features, but they often remain accessible on production devices through unpopulated header pins or labeled test points on the circuit board.

JTAG Boundary Scan and Memory Dump

JTAG provides standardized access to the device processor's debug facilities through a four-wire interface (TDI, TDO, TMS, TCK) plus an optional reset signal. Through JTAG, GDF's examiners can halt the processor, read and write memory contents, examine CPU register states, and in many cases perform a full memory dump of all memory regions accessible to the processor including flash storage, RAM, and peripheral registers.

The primary challenge in JTAG forensics is identifying the JTAG interface on an undocumented board. GDF uses JTAGulator and proprietary JTAG identification tools to scan available test points and identify JTAG signals through automated probing. Once identified, the JTAG chain is enumerated using OpenOCD or manufacturer-specific debug tools to identify the processor and its memory map. GDF extracts memory dumps sector by sector with hash verification of each acquisition segment.

Some devices implement JTAG security features including password-protected JTAG access, fuse-burned JTAG disable, or TrustZone-protected memory regions that prevent full memory access through JTAG even when the interface is physically accessible. GDF documents these limitations and their impact on data recovery in the expert report.

UART Console Access

Many embedded devices expose a UART serial console on debug pins that, when connected with appropriate voltage-level-shifting hardware, provides access to boot messages, a bootloader command interface, or a root shell depending on the device's security configuration. Even devices that restrict UART console access often expose useful forensic information through boot log messages: firmware version, kernel parameters, filesystem configuration, and initialization errors that characterize the device's operational state.

Where UART access provides a usable shell, GDF uses standard Linux forensic commands to collect running process lists, network connections, filesystem contents, and log file data. Where the shell is restricted, GDF attempts bootloader-level commands (U-Boot is the most common open-source bootloader in embedded Linux systems and provides memory dump capability in many configurations) to access storage contents independently of the operating system's access controls.

Firmware Analysis: Binwalk and Ghidra

Once firmware has been extracted from a device through chip-off, JTAG, or other means, the raw binary requires systematic analysis to identify its structure and recover forensically relevant content. Firmware analysis proceeds through several stages: unpacking, filesystem analysis, and where necessary, binary disassembly and reverse engineering.

Firmware Unpacking with Binwalk

Binwalk is the primary tool for firmware binary analysis, combining signature detection, entropy analysis, and recursive extraction to identify and unpack the components within a firmware image. A typical embedded Linux firmware binary contains multiple sections: a bootloader (U-Boot or equivalent), a compressed Linux kernel, and one or more compressed filesystem images (squashfs, cramfs, ext2, JFFS2, UBIFS, or others). Binwalk identifies each component by its magic byte signature, extracts it, and decompresses it into a usable form.

After extraction, Autopsy or custom Python scripts are applied to the extracted filesystem to recover artifact categories including:

• Stored credentials: hardcoded passwords, SSH keys, API keys, and authentication tokens in configuration files and application binaries
• Log files: system logs, application logs, and access logs recording device activity with timestamps
• Configuration files: network settings, user accounts, enabled services, and device-specific configuration data
• Database files: SQLite and other database formats used by device applications to store structured event, usage, and communication data
• Cached data: web caches, application caches, and temporary files containing residual content from device operation
• Deleted file recovery: identification and recovery of files deleted from flash filesystems using filesystem analysis and unallocated space carving

Binary Analysis with Ghidra

For matters where the analysis requires understanding the behavior of specific firmware code, GDF's analysts use Ghidra, the National Security Agency's open-source reverse engineering framework, to disassemble and decompile firmware binaries. Ghidra supports the processor architectures commonly used in embedded systems: ARM, MIPS, x86, RISC-V, and others, with architecture-specific analysis plugins that improve the quality of the decompiled output.

Ghidra-based analysis is applied in several forensic contexts:

• Tamper detection: Characterizing modifications made to device firmware to identify unauthorized additions, backdoors, or capability extensions
• Encryption and obfuscation analysis: Identifying and analyzing encryption routines used to protect stored data, to understand what data may be recoverable
• Supply chain analysis: Comparing firmware binary characteristics across samples from multiple devices to identify common-origin indicators or shared code components relevant to supply chain compromise matters
• Vulnerability analysis: Identifying security weaknesses in device firmware code that are relevant to product liability or negligence claims
• IP theft analysis: Comparing firmware binary structure, function organization, and code characteristics to assess whether a competitor's firmware was derived from a proprietary codebase

Flash Memory Acquisition and Data Recovery

Raw flash memory acquired through chip-off requires processing steps beyond simply reading the binary contents before it can be forensically analyzed. NAND flash in particular implements error correction codes (ECC) to compensate for the inherent bit error rate of NAND cells, and uses bad block management to retire sectors that have exceeded their write endurance. The raw data read from a NAND flash chip interleaves ECC bytes with data bytes in a layout determined by the flash controller, which must be identified and applied to extract the actual stored data.

GDF applies ECC decoding, bad block analysis, and NAND layout identification to produce a clean, usable image from raw chip-off data. For eMMC devices, the embedded controller manages ECC transparently, and the data interface presents a logical sector-addressed view that requires no additional decoding beyond standard sector-level reading.

Data recovery from flash memory applies file carving techniques to identify file structures in unallocated flash space where the filesystem has marked blocks as available but has not yet overwritten them. Flash memory's write-before-erase constraint means that data deleted at the filesystem level remains physically present in the flash cells until the flash controller's garbage collection process erases the block. This characteristic makes flash memory forensically advantageous compared to magnetic storage, where new data can be written directly over old data without the erase prerequisite.

Boundary Scan Analysis

Boundary scan (IEEE 1149.1 JTAG) testing extends beyond memory acquisition to board-level connectivity analysis. Each JTAG-compliant IC on a circuit board contains boundary scan cells at every input and output pin that allow the pins to be driven or sampled through the JTAG chain. This capability allows GDF to characterize board-level connectivity, identify component configurations, and document the electrical state of specific signals without requiring access to device firmware or operating software.

In forensic contexts, boundary scan analysis is applied to characterize suspected hardware modifications to embedded devices: verifying that component values and configurations match the expected bill of materials, identifying added or removed components, and characterizing the electrical state of interface signals that should or should not be active under normal operating conditions. This analysis complements the IC-level analysis provided by GDF's IC forensics practice for matters requiring full component-level examination.

Use Cases and Client Applications

Smart Home Device Evidence

Smart home devices present a significant and underutilized source of digital evidence in civil and criminal matters. Video doorbells record motion events and door activity with timestamps. Smart locks log lock and unlock events with the credential used and the timestamp. Smart speakers capture commands and ambient audio related to activation events. Smart plugs record power consumption patterns that document occupancy and appliance usage. IP cameras store event-triggered or continuous video locally or in cloud storage.

The forensic analysis recovers this data from the devices themselves when cloud access is unavailable or when the local data predates or extends beyond the cloud retention window. Analysis produces timestamped event logs, recovered video and audio files, and configuration records that establish device settings at the relevant time. For cloud-stored data from the same devices, GDF assists attorneys in identifying and requesting appropriate legal process from the device manufacturer or cloud service operator.

Drone and UAV Forensics

Unmanned aerial vehicles carry multiple data recording systems: flight controller logs recording orientation, GPS position, motor speeds, battery state, and control inputs throughout each flight; camera systems recording video and still images with embedded GPS coordinates and timestamps; and remote controller or mobile application logs documenting operator inputs and communications with the aircraft. This data supports litigation involving drone accidents, unauthorized flights over restricted areas, privacy violations, and insurance claims for drone damage or loss.

GDF's drone forensics examinations extract flight controller logs from the drone's embedded flash storage using chip-off or JTAG where necessary, recover camera media files with associated metadata, and where available, retrieve operator-side logs from the remote controller or paired mobile device. For paired mobile device records, GDF's mobile device forensics practice handles the smartphone or tablet component of the evidence set.

Industrial Device Tampering and Supply Chain Compromise

Industrial embedded systems in manufacturing, energy, water treatment, and transportation infrastructure are targets for tampering that can range from competitive intelligence gathering to sabotage. A firmware modification to an industrial sensor or controller can alter readings, disable safety functions, or create covert communication channels that are not visible through normal device management interfaces. Supply chain compromise introduces modified firmware or hardware into the production supply chain before the affected devices reach the end user.

GDF's tamper detection analysis for industrial devices applies firmware integrity verification against known-good reference firmware, binary comparison across device samples to identify individual devices with modified firmware, and hardware inspection for unauthorized component additions. Analysis findings support incident response, insurance claims for business interruption, product liability claims against equipment suppliers, and referrals to law enforcement or regulatory authorities where criminal tampering is indicated. For the network-level aspects of industrial device compromise, GDF's network forensics and SCADA security practices address the broader operational technology environment.

Insurance Claims: Device Tampering and Product Defects

Insurance claims involving embedded device failures present technical questions about whether the failure was caused by manufacturing defect, design error, user error, environmental conditions, or deliberate tampering. The forensic examination covers the firmware state at the time of failure (recovered from device flash memory), the device's operational logs, and the hardware condition of the device to characterize the failure and its cause. This analysis supports coverage determinations, subrogation against responsible parties, and defense against fraudulent claims where the alleged failure is inconsistent with the forensic evidence.

Professional Standards and Methodology

The practice is governed by the professional standards applicable to this specialized discipline:

• SWGDE Core Competencies for Embedded Device Forensics: The Scientific Working Group on Digital Evidence publishes core competency standards for embedded device forensics covering identification of device types, electronics knowledge required for safe device handling and interface probing, disassembly procedures, and data acquisition and processing. GDF's practitioners meet these competency standards
• NIST IR 8349: NIST's guidance on IoT network behavior characterization informs GDF's approach to characterizing embedded device network communications in IoT forensics matters
• ISO/IEC 27037: International standard for digital evidence identification, collection, acquisition, and preservation, applied to embedded device evidence handling including chain of custody documentation, write protection, and hash verification
• ISO/IEC 27041: Standard for investigation assurance in digital forensics, governing GDF's methodology documentation and quality control processes
• ISO/IEC 27042: Standard for analysis and interpretation of digital evidence, applied to GDF's firmware analysis methodology and report preparation
• ISO/IEC 27043: Standard for incident investigation principles and processes, applied to GDF's embedded device forensics workflow in incident response contexts
• ASTM E3016: Standard guide for establishing confidence in digital and multimedia evidence, referenced in GDF's quality control framework for embedded systems forensics findings

GDF validates all specialized tools used in embedded systems forensics against SWGDE minimum requirements for testing tool validation, documenting tool performance for the specific device types and memory configurations encountered in each case. This validation documentation is preserved in the case file and is available for review by opposing experts or the court.

Expert Reports and Testimony

The highly specialized nature of embedded systems forensics requires expert reports that bridge the technical complexity of the analysis and the practical evidentiary questions the case presents. GDF's expert reports on embedded systems matters are structured to present technical methodology in terms that non-technical readers can follow, document the specific tools and procedures used at each step, explain the significance of recovered data in the context of the matter at issue, and acknowledge any limitations on the completeness or certainty of the findings.

GDF examiners are available to testify as expert witnesses in federal and state court proceedings, arbitrations, and administrative hearings on embedded systems forensics matters. Expert witness engagements include preparation for deposition, review of opposing expert reports, preparation of rebuttal analysis where technical findings are in dispute, and trial testimony. GDF has provided expert testimony on IoT device forensics, drone forensics, and industrial device tampering matters in proceedings across the United States.