Difference between pages "Hashkeeper" and "JTAG and Chip-Off Tools and Equipment"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
m
 
(Added Sireda adapters for chip-off work.)
 
Line 1: Line 1:
Run by the National Drug Intelligence Center, part of the U.S. Department of Justice.
+
The following list contains equipment used for performing JTAG and chip-off analysis.  It is noted when equipment is used for both procedures in order to avoid overlap and duplication of equipment. The URL's provided are for reference and other vendors and suppliers exist for said equipment. Please search Internet for other competitive vendors.
  
'''HashKeeper''' is a database application of value primarily to those conducting forensic examinations of computers on a somewhat regular basis.
+
''Note: This equipment is not a definitive list and substitutions can be made for equivalent tools and equipment.''
  
== Overview ==
+
'''JTAG and Chip-Off Equipment List'''
The application uses the [[MD5]] file signature algorithm to establish unique numeric identifiers (hash values) for known files and compares those known hash values against the hash values of Computer file|files on a seized computer system. Where those values match, the examiner can say, with statistical certainty, that the corresponding files on the seized system have been authenticated and therefore do not need to be examined.
+
  
== Origins ==
+
{| class="wikitable"
 +
! align="left"| Item
 +
! Info
 +
! Estimated Cost (CAD)
 +
|-
 +
|Carton SPZT-50PG Microscope (optional: w/trinocular)
 +
|http://valleymicroscope.com/shop/spz-50pg/
 +
|$1200
 +
|-
 +
|Xytronic 988D Solder Rework Station
 +
|http://www.howardelectronics.com/xytronic/988d.html
 +
|$300
 +
|-
 +
|Weller WES51 Solder Station
 +
|sourced locally (Electronics shop)
 +
|$100
 +
|-
 +
|Xytronic LF-852D Hot Air Station
 +
|http://www.howardelectronics.com/xytronic/LF-852D.html
 +
|$225
 +
|-
 +
|HP Agilent U8002A Variable Power Supply
 +
|http://www.home.agilent.com/agilent/product.jspx?pn=u8002a&cc=CA&lc=eng
 +
|$400
 +
|-
 +
|Amprobe 35XP Multimeter
 +
|sourced locally (Electronics shop)
 +
|$120
 +
|-
 +
|Magnifying Desk Lamp
 +
|http://www.amazon.com/Ultra-Efficient-LED-Magnifier-Lamp-Adjustable/dp/B001064VTE
 +
|$100
 +
|-
 +
|Circuit board holder
 +
|http://www.ibreakityoufixit.com/shop/mounting-kit
 +
|$13
 +
|-
 +
|Chip Epoxy Glue Remover
 +
|http://www.ebay.com/itm/BGA-IC-30ml-IC-BGA-CPU-Chip-Epoxy-Glue-Remover-Adhesive-Solution-Solvent-Liquid-/321012736931?pt=Digital_Camera_Accessories&hash=item4abdd9a3a3
 +
|$10
 +
|-
 +
|0.040 gauge transformer winding wire
 +
|sourced locally (Electronics shop)
 +
|$15
 +
|-
 +
|Kester 44 rosin flux solder
 +
|sourced locally (Electronics shop)
 +
|$50
 +
|-
 +
|Xcelite Hobby Knives
 +
|sourced locally (Electronics shop)
 +
|$15
 +
|-
 +
|Terra Dexterity PVC foam gloves
 +
|sourced locally (Costco)
 +
|$10
 +
|-
 +
|8" x 8" x 3/8" steel plate
 +
|sourced locally (Steel fabrication shop)
 +
|free
 +
|}
  
Created by the National Drug Intelligence Center (NDIC)—an agency of the United States Department of Justice—in 1996, it was the first source for hash values of "known to be good" files.
+
'''JTAG Specific Equipment List'''
  
== Availability ==
+
{| class="wikitable"
HashKeeper is available, free-of-charge, to law enforcement, military and other government agencies throughout the world. It is available to the public by sending a [http://www.usdoj.gov/ndic/foia.htm Freedom of Information Act] request to NDIC.
+
! align="left"| Item
 +
! Info
 +
! Estimated Cost (CAD)
 +
|-
 +
|RIFF Box
 +
|http://www.multi-com.pl/index.php/en_US,details,id_pr,7883,menu_mode,categories.html
 +
|$120
 +
|-
 +
|Octoplus Box
 +
|http://gsmserver.com/shop/gsm/octoplus_box_full_set.php
 +
|$340
 +
|}
  
== Tools ==
 
* Example script ([[Media:Hashkeeper.txt]]) to produce a pair of '''Hashkeeper''' format files for a given set of target files (can be imported into [[EnCase]]).
 
  
== External Links ==
+
'''Chip-Off Specific Equipment List'''
* [http://www.usdoj.gov/ndic/about.htm Official NDIC website]
+
* [http://tech.groups.yahoo.com/group/hashkeeper/ Hashkeeper mailing list]
+
  
[[Category:Hashing]]
+
{| class="wikitable"
 +
! align="left"| Item
 +
! Info
 +
! Estimated Cost (CAD)
 +
|-
 +
|Wagner HT1000 Heat Gun
 +
|http://www.wagnerspraytech.com/portal/ht1000_en_spray,362096,358970.html
 +
|$30
 +
|-
 +
|Heat Gun stand
 +
|http://www.ibreakityoufixit.com/shop/air-gun-holder
 +
|$60
 +
|-
 +
|UP-828 Programmer
 +
|http://www.up48.com/english/programmer/up828.htm
 +
|$1300 - $1700 depending on source
 +
|-
 +
|UP-828 SBGA152 Adapter
 +
|BlackBerry
 +
|$600 - $1000 depending on source
 +
|-
 +
|UP-828 BGA110 Adapter
 +
|
 +
|$600 - $1000 depending on source
 +
|-
 +
|UP-828 VBGA169E Adapter
 +
| BlackBerry and Android
 +
|$600 - $1000 depending on source
 +
|-
 +
|UP-828 VBGA133 Adapter
 +
|iPhone 4
 +
|$600 - $1000 depending on source
 +
|-
 +
|Sireda eMMC Test Socket Adapters
 +
|http://www.teeltech.com/forensic-tools/sireda-adapter-kit/
 +
|$2200
 +
|}
 +
 
 +
'''Notes'''
 +
 
 +
1. The UP-828 driver is not signed and therefore doesn't work by default in Windows 7 64-bit. The programmer is identified as a as a Cypess Semiconductor Corp. CY7C68013. The signed Windows 7 64-bit driver can be installed by downloading and installing the Cypress EZ-USB FX2LP Development Kit, then using the CyUSB.sys driver found in '<installdir>\CY3684_EZ-USB_FX2LP_DVK\1.0\Drivers\cyusbfx1_fx2lp' for the UP-828 programmer.

Revision as of 13:56, 18 April 2014

The following list contains equipment used for performing JTAG and chip-off analysis. It is noted when equipment is used for both procedures in order to avoid overlap and duplication of equipment. The URL's provided are for reference and other vendors and suppliers exist for said equipment. Please search Internet for other competitive vendors.

Note: This equipment is not a definitive list and substitutions can be made for equivalent tools and equipment.

JTAG and Chip-Off Equipment List

Item Info Estimated Cost (CAD)
Carton SPZT-50PG Microscope (optional: w/trinocular) http://valleymicroscope.com/shop/spz-50pg/ $1200
Xytronic 988D Solder Rework Station http://www.howardelectronics.com/xytronic/988d.html $300
Weller WES51 Solder Station sourced locally (Electronics shop) $100
Xytronic LF-852D Hot Air Station http://www.howardelectronics.com/xytronic/LF-852D.html $225
HP Agilent U8002A Variable Power Supply http://www.home.agilent.com/agilent/product.jspx?pn=u8002a&cc=CA&lc=eng $400
Amprobe 35XP Multimeter sourced locally (Electronics shop) $120
Magnifying Desk Lamp http://www.amazon.com/Ultra-Efficient-LED-Magnifier-Lamp-Adjustable/dp/B001064VTE $100
Circuit board holder http://www.ibreakityoufixit.com/shop/mounting-kit $13
Chip Epoxy Glue Remover http://www.ebay.com/itm/BGA-IC-30ml-IC-BGA-CPU-Chip-Epoxy-Glue-Remover-Adhesive-Solution-Solvent-Liquid-/321012736931?pt=Digital_Camera_Accessories&hash=item4abdd9a3a3 $10
0.040 gauge transformer winding wire sourced locally (Electronics shop) $15
Kester 44 rosin flux solder sourced locally (Electronics shop) $50
Xcelite Hobby Knives sourced locally (Electronics shop) $15
Terra Dexterity PVC foam gloves sourced locally (Costco) $10
8" x 8" x 3/8" steel plate sourced locally (Steel fabrication shop) free

JTAG Specific Equipment List

Item Info Estimated Cost (CAD)
RIFF Box http://www.multi-com.pl/index.php/en_US,details,id_pr,7883,menu_mode,categories.html $120
Octoplus Box http://gsmserver.com/shop/gsm/octoplus_box_full_set.php $340


Chip-Off Specific Equipment List

Item Info Estimated Cost (CAD)
Wagner HT1000 Heat Gun http://www.wagnerspraytech.com/portal/ht1000_en_spray,362096,358970.html $30
Heat Gun stand http://www.ibreakityoufixit.com/shop/air-gun-holder $60
UP-828 Programmer http://www.up48.com/english/programmer/up828.htm $1300 - $1700 depending on source
UP-828 SBGA152 Adapter BlackBerry $600 - $1000 depending on source
UP-828 BGA110 Adapter $600 - $1000 depending on source
UP-828 VBGA169E Adapter BlackBerry and Android $600 - $1000 depending on source
UP-828 VBGA133 Adapter iPhone 4 $600 - $1000 depending on source
Sireda eMMC Test Socket Adapters http://www.teeltech.com/forensic-tools/sireda-adapter-kit/ $2200

Notes

1. The UP-828 driver is not signed and therefore doesn't work by default in Windows 7 64-bit. The programmer is identified as a as a Cypess Semiconductor Corp. CY7C68013. The signed Windows 7 64-bit driver can be installed by downloading and installing the Cypress EZ-USB FX2LP Development Kit, then using the CyUSB.sys driver found in '<installdir>\CY3684_EZ-USB_FX2LP_DVK\1.0\Drivers\cyusbfx1_fx2lp' for the UP-828 programmer.