Creating an Image

After the chip has been removed and properly cleaned, through either thermal or nonthermal means, it must be read and imaged. The process will require a number of different chip readers and various programmers. Programmers are not actually used to program the chip, but instead used to read the contents. Chips will come in various configurations and sizes. Some readers may also require the chip to be reballed for the pins inside the reader to contact the required Ball Grid Arrays. Once the chip is able to be “seen” by the actual reader, it must be imaged. The “image” is a process by which the content of the chip is copied and validated for changes. The image that is created is then read and rebuilt using forensic tools. The tools can decode the contents, rebuilding partitions, applications, and various forms of stored user data. Additional ways of searching such as regular expressions can be conducted.