Difference between pages "Palm" and "Damaged SIM Card Data Recovery"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
(added Audrey info)
 
 
Line 1: Line 1:
__TOC__
+
== Summary ==
  
=Overview=
+
A prerequisite for the use of SIMIS, is that the SIM card must be functional. A physically damaged, broken or dirty SIM may not function correctly, resulting in the recovery of corrupted data, or no data at all. In the forensic data recovery environment, SIM's will be presented in a variety of different conditions, ranging from good, but lightly soiled, through blood soaked to physically broken. Lightly soiled and blood soaked SIM's may be cleaned using appropriate methods, ensuring that the SIM is not further damaged taking care to preserve surface printing where possible.
  
A "Palm" is a commonly referred to as a small-scale (hand-held) computer that runs Palm's PalmOS software.
+
However, physically damaged or broken SIM's require more specialised processing to produce a viable SIM for data recovery purposes. Crownhill has extensive experience in the area of SIM data recovery through its activity in the SIM manufacturing process. Crownhill works directly with the SIM silicon manufacturers and SIM card manufacturers. Processes developed to aid fault analysis and qualitative measurements are an invaluable advantage when attempting to repair and recover data from physically damaged SIM modules.
  
== History ==
+
Crownhill have invested in purpose-built laboratory facilities to provide professional card cleaning, data recovery and card repair service. Based in discrete, secure premises, Crownhill can provide the full compliment of services required to clean, repair and recover data from damaged SIM's. Drawing on its own expertise and relationships with Card manufacturers and silicon vendors world-wide, Crownhill have created a centre of excellence for this specialised work. An overview of the procedures can be found here
  
Palm Computing was founded by Jeff Hawkins, Donna Dubinsky and Ed Colligan. The original purpose of the company was to create handwriting recognition software for other devices (Graffiti). The initial idea for the devices came from Hawkins' habit of carrying a block of wood in his pocket.
+
Where a SIM is thought to be functional, Crownhill can provide a SIM cleaning service. Blood, soot, general soiling and body fluids are handled in an environmentally secure fashion, relieving the client of responsibility for Bio Hazards and other Health and Safety issues. Cleaned SIM's are returned without undue delay, ready for data recovery by the client. Cleaning by Crownhill must be carried out after the SIM has been pre-processed for any physical evidence required, such as Photography and DNA sampling.
 +
Data Recovery Process
  
The initial Palm device released in 1996 was called the Pilot.  Because Pilot Pen Corporation brought forth a trademark infrigement case, the second generation device released in 1997 was named the PalmPilot. 
+
== Data Recovery Process ==
  
The Palm was not the original PDA device released, but benefited from the failure of Apple's Newton.
+
If our findings suggest that data recovery is likely to be possible, the SIM may further examined by real time X-ray, to determine the extent of the damage. Specifically we will be looking for broken or damaged wire bonds, detachment of the silicon die and possible fractures of the die.
  
The Palm OS initially featured personal information management (PIM) tools such as Calendar, Contacts, Memo Pad, Expense and Tasks. 
+
=== Decapsulation ===
  
Presently, version 6.0 of the Palm OS is under development (Cobalt). Cobalt features a Linux-based kernel.  There are presently no devices released using Palm OS 6.  
+
Where a damaged bond wire(s) is clearly identified and if there is no obvious damage to the silicon die, the die encapsulation can be removed. The de-capsulation process requires a great deal of skill and the use of proprietary mixes of aggressive solvents and/or acids. The exact process used depends upon the.
  
=Features=
+
=== Testing ===
<table>
+
<tr>
+
<td>'''Address Book''': Allows the user to keep track of their contacts.  Synchronized via HotSync manager</td>
+
</tr>
+
<tr>
+
<td>'''Calculator''': Basic 4 function calculator</td>
+
</tr>
+
<tr>
+
<td>'''Datebook''': Track appointments, birthdates and other important times during the year.  Synchronized via HotSync manager</td>
+
</tr>
+
<tr>
+
<td>'''Expenses''': Keep track of your spending habits.</td>
+
</tr>
+
<tr>
+
<td>'''HotSync''': Application that ran on your desktop or portable PC or Mac to allow for calendars and contacts to easily be synchronized with Palm device.</td>
+
</tr>
+
<tr>
+
<td>'''Memo Pad''': Write short notes.</td>
+
</tr>
+
<tr>
+
<td>'''Note Pad''': Scribble notes in your natural writing language.</td>
+
</tr>
+
<tr>
+
<td>'''To Do List''': Create a check list of items to accomplish.  Synchronized via HotSync manager.</td>
+
</tr>
+
<tr>
+
<td>'''Palm Photos''': Photo manager that allows sharing of photos between multiple palm devices.</td>
+
</tr>
+
</table>
+
  
=Palm Variants=
+
After de-capsulation, further electrical tests are carried out to confirm the viability of the recovered silicon die. The die bonding pads are then probed and once electrical connection is established, the silicon is accessed and the sim data recovered using proprietary software.
  
-Version 3.1, 3.3, 3.5
+
=== X-Rays ===
Added support for color, multiple expansion ports, new processors, etc.
+
  
-Version 4.0
+
Real time X-ray examination is used to confirm the conclusions drawn from the preceding Physical, Optical and Electrical tests. X-ray examination is only undertaken where the integrity of the silicon die is thought to be uncompromised.
Added a standard interface for external FS access
+
  
-Version 5.0
+
== References ==
First version to support Acorn Risc Machine (ARM) devices. Later versions which included OS 4.1.2 and 5.2, featured Graffiti 2. It began the separation of Palm OS and Palm One.
+
  
-Version 6
+
1. http://www.3gforensics.co.uk/sim-card-data-recovery.htm
Allowed ARM applications with multimedia support.
+
 
+
==Palm Pilot==
+
 
+
==3Com Audrey==
+
 
+
The 3Com Audrey was created to be a kitchen computer in 2000-2001.  It was a mainly a used to access the Internet.  Cisco then bought out 3Com and the Audrey was no more.  One noticeable aspect of the Audrey is how people can hack it.  They have turned it into anything from a web server to a chatting client.  It runs QNX with PalmOS extensions.  This allows it to be hacked extremely easily.
+
 
+
==Fossil==
+
 
+
==Garmin==
+
 
+
==Kyocera==
+
 
+
==QualComm==
+
 
+
==Samsung==
+
 
+
==Sony Cli&Egrave;==
+
 
+
==Symbol==
+
 
+
==TapWave==
+
 
+
==TRG==
+
 
+
==Handspring Visor==
+
 
+
The original creators of the PalmPilot, Jeff Hawkins, Donna Dubinsky, and Ed Colligan, left Palm Computing after desputes with the parent company 3com. As a result, the trio founded Handspring in 1998. The first product released in 1999 was called the Handspring Visor, a clone of the original PalmPilot with minor additions, that used the newly created Palm OS. One of it's most prominent features was USB support and an expansion slot for memory cards, both of which were not yet popular at the time.
+
 
+
The Visor line includes:
+
<ul>
+
<li>Visor and Visor Deluxe</li>
+
<li>Visor Prism</li>
+
<li>Visor Platinum</li>
+
<li>Visor Edge</li>
+
<li>Visor Neo</li>
+
<li>Visor Pro</li>
+
</ul>
+
 
+
==Treo==
+
-Treo 600
+
Is a smartphone that combines the color of Palm OS PDA with a mobile phone.
+
<table border="1">
+
<th>Key Features</th>
+
<tr>
+
<td>Batteries</td>
+
<td>Built in rechargeable lithium ion batteries</td>
+
</tr>
+
<tr>
+
<td>Storage</td>
+
<td>32MB Ram</td>
+
</tr>
+
<tr>
+
<td>Memory Slots</td>
+
<td>SDIO, SD, MMC</td>
+
</tr>
+
<tr>
+
<td>Communications</td>
+
<td>Infrared comm port</td>
+
</tr>
+
<tr>
+
<td>MP3 and Headset Support</td>
+
</tr>
+
</table>
+
 
+
<table>
+
<th>References:</th>
+
<tr>
+
<td>http://www.answers.com/topic/palm-os</td>
+
</tr>
+
<tr>
+
<td>http://www.answers.com/main/ntquery?method=4&dsid=2222&dekey=Treo+600&gwp=8&curtab=2222_1&linktext=Treo%20600</td>
+
</tr>
+
</table>
+

Revision as of 01:20, 24 September 2008

Summary

A prerequisite for the use of SIMIS, is that the SIM card must be functional. A physically damaged, broken or dirty SIM may not function correctly, resulting in the recovery of corrupted data, or no data at all. In the forensic data recovery environment, SIM's will be presented in a variety of different conditions, ranging from good, but lightly soiled, through blood soaked to physically broken. Lightly soiled and blood soaked SIM's may be cleaned using appropriate methods, ensuring that the SIM is not further damaged taking care to preserve surface printing where possible.

However, physically damaged or broken SIM's require more specialised processing to produce a viable SIM for data recovery purposes. Crownhill has extensive experience in the area of SIM data recovery through its activity in the SIM manufacturing process. Crownhill works directly with the SIM silicon manufacturers and SIM card manufacturers. Processes developed to aid fault analysis and qualitative measurements are an invaluable advantage when attempting to repair and recover data from physically damaged SIM modules.

Crownhill have invested in purpose-built laboratory facilities to provide professional card cleaning, data recovery and card repair service. Based in discrete, secure premises, Crownhill can provide the full compliment of services required to clean, repair and recover data from damaged SIM's. Drawing on its own expertise and relationships with Card manufacturers and silicon vendors world-wide, Crownhill have created a centre of excellence for this specialised work. An overview of the procedures can be found here

Where a SIM is thought to be functional, Crownhill can provide a SIM cleaning service. Blood, soot, general soiling and body fluids are handled in an environmentally secure fashion, relieving the client of responsibility for Bio Hazards and other Health and Safety issues. Cleaned SIM's are returned without undue delay, ready for data recovery by the client. Cleaning by Crownhill must be carried out after the SIM has been pre-processed for any physical evidence required, such as Photography and DNA sampling. Data Recovery Process

Data Recovery Process

If our findings suggest that data recovery is likely to be possible, the SIM may further examined by real time X-ray, to determine the extent of the damage. Specifically we will be looking for broken or damaged wire bonds, detachment of the silicon die and possible fractures of the die.

Decapsulation

Where a damaged bond wire(s) is clearly identified and if there is no obvious damage to the silicon die, the die encapsulation can be removed. The de-capsulation process requires a great deal of skill and the use of proprietary mixes of aggressive solvents and/or acids. The exact process used depends upon the.

Testing

After de-capsulation, further electrical tests are carried out to confirm the viability of the recovered silicon die. The die bonding pads are then probed and once electrical connection is established, the silicon is accessed and the sim data recovered using proprietary software.

X-Rays

Real time X-ray examination is used to confirm the conclusions drawn from the preceding Physical, Optical and Electrical tests. X-ray examination is only undertaken where the integrity of the silicon die is thought to be uncompromised.

References

1. http://www.3gforensics.co.uk/sim-card-data-recovery.htm