Rep: 1
1
What is the likelihood that data can be forensically recovered directly from a Toshiba THGBX2G7B2JLA01 (or similar memory device) while either attached or detached from its logic board?
Is this a good question?
Rep: 1.6k
4
4
6
None. Sorry to be the bearer of bad news.
The NAND is encrypted by AES256, with a key generated by the CPU of the device, that is stored on the EEPROM IC. It may be possible to change all 3 of these things onto another board to recover the data if you know the passcode ect, but the risk of doing so is incredibly high, and it would cost you hundreds.
In saying this, what is wrong with the board that contains the data? Its highly likely to be cheaper to fix it.
For a list of board level techs and to find one near you, head to my profile. There's a link of highly recommended techs there
Was this answer helpful?
Well, if he's from the FBI, I know what he wants to get off the board.
Past 24 Hours: 0
Past 7 Days: 0
Past 30 Days: 0
All Time: 1,467
1 Comment
I should have mentioned that I am familiar with the on board encryption methodology when I first posted. I regret the oversight.
My question really drives to whether or not the encrypted contents could be pulled off the chip for further forensic processing (assume, for the sake of argument, that the distributed horsepower is available to perform the necessary decryption off-board in a reasonably timely manner; and that the board is in good and usable condition.)
by gomberg