Electrically conductive adhesives, thermally conductive adhesives and [626104]

Electrically conductive adhesives, thermally conductive adhesives and
UV adhesives in data extraction forensics
Thibaut Heckmanna,b,*, Thomas Souvigneta,b, David Naccacheb
aInstitut de Recherche Criminelle de la Gendarmerie Nationale, Digital Forensics Department (INL), 5, boulevard de l'Hautil, 95300 Cergy-Pontoise , France
bEcole normale sup /C19erieure, Information Security Group, Computer Science Department, 45, rue d'Ulm, 75230 Paris, France
article info
Article history:
Received 18 December 2016Accepted 27 February 2017
Available online xxx
Keywords:
Forensic rework
Hardware forensics
Adhesives propertiesabstract
Recent publications underline the interest of using polymers in microelectronics (Li and Wong, 2006a;
Cui et al., 2014). Polymers are the ideal interconnect alternative to solder materials containing lead.
Electrically Conductive Adhesives [ECAs] (Li and Wong, 2006b), Thermally Conductive Adhesives (TCAs)(Felba et al., 2011) and UV Adhesives (UVAs) (Asif et al., 2005) mainly consist of a polymeric resin (epoxy,silicon, polyurethane or polyimide) that provides physical and mechanical properties such as adhesion,
mechanical strength while containing metal fillers (silver, gold, nickel or copper) that conduct electricity
(Luo et al., 2016). Currently it is possible to find really cheap polymeric resin. Using these resins for digital
forensic purposes is the focus of this paper, that we demonstrate in a hardware reverse engineering
prototype case study.
When considering new mobile devices, such as secure phones, it is often necessary to spy commu-
nication and perform numerous tests on the memory (e.g. by changing some bytes) to understand or
modify the implemented security mechanisms (manipulate system time, locate password hashes,
observe artefacts of implemented security algorithms, etc.). Traditional techniques use either laser at-tacks/probing (chip on) or soldering/read/re-soldering (chip off/on) (Heckmann et al., in press, Jongh,2014). These two techniques are unsuitable for repeated operations requiring many readings/changes/
injections. This paper describes a concrete case study using adhesive properties complementary to chip
on and chip off methods.
We present the steps using different properties of adhesives (ECA, TCA, UVA) that we will lead to the
realisation of a prototype particularly suitable for the repeating of the read phases/changes/injections
necessary for reverse engineering secure mobile devices.
©2017 Elsevier Ltd. All rights reserved.
Introduction
This paper shows how the use of adhesives properties (solidi-
fication rate, proportion of mixtures, physical properties) can allow
to repair electronic circuits (creating track, PCB insulation) and
weld BGA components at ambient temperature without traditionalsoldering pastes. We also aim to demonstrate how the use of ad-
hesives can help extraction specialists to recover data contained in
electronic components and thereby facilitate the reverse engi-
neering of security mobile devices.When considering new mobile devices, such as secure phones,
it is often necessary to spy communication between the various
internal components and perform numerous tests on the mem-
ory (e.g. by changing some bytes) to understand or bypass the
security mechanisms implemented by the initial system de-
signers ( Breeuwsma et al., 2007; Mishra et al., 2016 ). Several
methods can help forensic examiners to read the memory of
secure phones:
/C15laser attack e“chip on ”method;
/C15de-soldering, reading, writing, re-balling, re-soldering e“chip
off/on ”method.
On one hand, what limits laser probing is the dif ficulty to inject
the data that we want to change. Unlike reading, rewriting requires
a large number of electronic probes that are dif ficult to position on
micro-electronic components.*Corresponding author. Institut de Recherche Criminelle de la Gendarmerie
Nationale, Digital Forensics Department (INL), 5, boulevard de l'Hautil, 95300
Cergy-Pontoise, France.
E-mail addresses: thibaut.heckmann@gendarmerie.interieur.gouv.fr
(T. Heckmann), thomas.souvignet@gendarmerie.interieur.gouv.fr (T. Souvignet),
david.naccache@ens.fr (D. Naccache).
Contents lists available at ScienceDirect
Digital Investigation
journal homepage: www.elsevier.com/locate/diin
http://dx.doi.org/10.1016/j.diin.2017.02.009
1742-2876/ ©2017 Elsevier Ltd. All rights reserved.Digital Investigation xxx (2017) 1 e12
Please cite this article in press as: Heckmann, T., et al., Electrically conductive adhesives, thermally conductive adhesives and UV adhesives in
data extraction forensics, Digital Investigation (2017), http://dx.doi.org/10.1016/j.diin.2017.02.009

On the other hand, the de-soldering solution is limited by the
significant time required to perform repetitive steps: de-soldering,
reading, modifying, re-writing, re-balling and re-soldering. Thus to
study the behaviour of a secure device the forensic expert need to
test many changes (in the case of R &D), and perform welding and
re-soldering several times.
This paper describes a complementary method to both laser
(chip on) and soldering/re-soldering (chip off/on) ( Miao and Duh,
2001; Puttlitz and Stalter, 2004; Rechchach, 2011 ). We will pre-
sent an intermediate method, which we call the Chip Adhesives
Method (CAM), using the properties of adhesives ( Li and Wong,
2006a; Cui et al., 2014 ) (Electrically Conductive Adhesive (ECA),
Thermally Conductive Adhesive (TCA) and UV Adhesive (UVA)).
We will set-up a system enabling us to carry-out many tests very
quickly: change phone parameters, recover unlocking passwords,
recover encryption passwords, etc. In a forensic context, the aboveis particularly interesting as it allows the original dump rewriting.
This new method allows the forensic investigator to realise many
tests very quickly without having, each time, to solder and re-solder
the memory chips. After having introduced the polymers' proper-
ties, selected some adhesives and analysed their composition, we
will present digital forensic use cases. Next we describe our new
rework method and its application to the reverse engineering of
secure systems. Finally, we present the results of our studies,
describe our prototype and discuss limits and optimisations.
Material
Thermal conductive adhesives
This polymer family is designed to dissipate heat ( Felba et al.,
2011; Falat et al., 2007 ). Generally, this adhesive covers memory
components and CPUs to reduce chip heating and improve stur-
diness, which makes chip-off analyses seriously more dif ficult (see
Fig. 1 ).
The consequence of using a classical chip-off process is the ne-
cessity to increase of the de-soldering temperature which may
seriously damage the chip and the board ( Fig. 2 b).
The thermal conductive adhesives studied in this paper (Poly-
tec
1) consist of a two components: resin and hardener. The mixing
ratio by weight is 100 resin units for 6 hardener units. Viscosity at23/C14C is 9000 mPa $s and minimum bond line cure schedule is 16 h
at 23/C14C and 15 min at 100/C14C(Fig. 3 ).
Thus, this adhesive is very well-suited for the fixing, covering
and coasting of electronic parts. The solidi fication is slow, which
allows to shape the fixation. It is possible to vary the solidi fication
rate by modulating the temperature.
UV adhesives studies
UV-curable adhesives can be categorised by their mechanical
properties, viscosity, hardness and the desired adhesive strength on
selected substrates ( Asif et al., 2005; Kim et al., 2002; Zhang et al.,
2014 ). Thus, reading the properties is essential to choose the right
feature for the desired effect.
The UVA we studied (Polytec UV2) is a single UV light curable
liquid acrylic adhesive component. Viscosity is 900 mPa $s and this
adhesive will cure within 45 s upon exposure to UV light at
320e450 nm ( Fig. 4 ).
Electrical conductive adhesives
Research efforts ( Cui et al., 2013; Li and Wong, 2006b; Moon
et al., 2004; Luo et al., 2016 ) have focused on two lead-free alter-
natives, lead-free metal solder alloys ( Heckmann et al., in press )
and polymer based ECAs ( Rechchach, 2011 ).
ECAs consist of an organic/polymeric binder matrix and metal
filler ( Fig. 5 ). ECAs are the ideal interconnect alternative to lead-
based solder materials. The conductive fillers provide the elec-
trical properties and the polymeric matrices provide the physical
and mechanical features ( Kishi et al., 2016 ) (see Fig. 6 ).
Fig. 1. TCA used for BGA soldering with board eSource: ( Zhang et al., 2013 ).
Fig. 2. Printed circuit board after de-soldering.
Fig. 3. Thermal adhesive absorbance.
1http://www.polytec.com//produits/colles-revetements-equipements/resines-
epoxy-polytec-pt/colles-epoxy/epoxy-thermique/ .2http://www.polytec.com//produits/colles-revetements-equipements/colles-a-
polymerisation-uv/colles-uv-polytec-pt/ .T. Heckmann et al. / Digital Investigation xxx (2017) 1 e12 2
Please cite this article in press as: Heckmann, T., et al., Electrically conductive adhesives, thermally conductive adhesives and UV adhesives in
data extraction forensics, Digital Investigation (2017), http://dx.doi.org/10.1016/j.diin.2017.02.009

The ECA that we studied (Polytec3) is an electrically conductive,
mechanically stable and flexible polyurethane dispersion. The ECA
is suggested for electrically conductive bonding and coating
applications.
The polyurethane combines very high flexibility degree with
good mechanical stability. The melting point is 250/C14C and the
polyurethane's softening range is 180/C14C. Drying time at 23/C14Ci s
8 min and viscosity is 5000 mPa $s. Thus, this adhesive is very well-
suited for gluing when quick fixing is required.
Digital forensic applications
As shown in the previous sections, adhesives have various and
numerous properties. The Forensic application of polymer-basedadhesives are as wide as the polymer based adhesives are. How-
ever, we will only focus on three main forensic data extraction
challenges: electronic circuit repair, low temperature reworking
and prototyping.
Electronics circuit repair
Printed Circuit Board (PCB) repair is the main issue when
considering damaged exhibits. The related challenges are often to
restore intentionally broken circuits and/or any isolated layers.
Restoring conductivity
Damaged exhibits (received broken or damaged during the
extraction process) may be required to restore the conductivity of
data lines, control lines or power lines.
Conductive adhesives are suitable to obtain such a result. A basic
approach consists in identifying the broken part ( Fig. 7 a),finding
the remaining parts of the broken line(s) ( Fig. 7 b), preparing the
parts to be connected ( Fig. 7 c) and joining them using a suitable
conductive adhesive mixture ( Fig. 7 d).
If most of the repairs would only require rough repair using
basic conductive adhesive, some may require quite fine artwork.
Some speci fic conductive adhesive (such as Polytec,4Aremco5or
Loctite6) may also be used to repair bonding wires. In that case, we
are able to communicate with the silicon by creating a conductive
bridge between the two parts of the broken bonding wires.
Restore insulation
PCBfixing may also be required to replace damaged isolation
layers. This is particularly suitable when a chip is over lapped or
when the PCB underneath layer is accidentally removed while de-soldering an under filled chip.
To restore the insulation of a damaged board, it is first necessary
to clean the damaged area using a flux remover ( Fig. 8 a). The pre-
pared insulating glue bi-phase mixture ( Fig. 8 b) applied at viscosity
state ( Fig. 8 c) will then create a thin insulation layer ( Fig. 8 d). Once
dry, the excess insulating adhesive can be removed using a micro
knife ( Fig. 8 e) to bring up the PCB connection ( Fig. 8 f). Finally, filling
in the throne with some electrically conductive adhesive ( Fig. 8 g)
permits to recreate pad over the insulation layer ( Fig. 8 h).
As demonstrated, ECA can be used to recreate a very thin iso-
lated layer. Thermal resistance of the polymer mixture is a crucial
parameter if the related surface has to be reheated for reworking
purposes.
Reworking
Reworking without damaging the evidence is the real forensic
data extraction challenge that is sometimes necessary when the
only way to extract the data is to replace a de-soldered component
(e.g. memory) back to the donor board or its original one. To pre-
vent overheating, recent articles ( Jongh, 2014; Heckmann et al., in
press ) propose different ways to use Bismuth eTin alloy in order
to reduce heating within the re-soldering process down to 150
/C14C.
If such low temperature pro files can save most of the chip from
overheating damages, it may not prevent some very sensitive or
heat protected memory chip from being damaged. Electrical
conductive adhesive can also be used to re-solder a chip at room
temperature.
Fig. 4. UV adhesive absorbance.
Fig. 5. Ball created by an assembly of a polymeric binder matrices and metal fillere
Source: ( Li and Wong, 2006a ).
Fig. 6. SEM observation of Polytech ECA.
3http://www.polytec.com/fr/produits/colles-revetements-equipements/resines-
epoxy-polytec-pt/colles-epoxy/epoxy-electrique/ .4http://www.polytec-pt.com/int/products/epoxy-adhesives/electrically-
conductive-adhesives/ .
5http://www.aremco.com/ .
6http://na.henkel-adhesives.com/industrial/equipment-solutions-19440.htm .T. Heckmann et al. / Digital Investigation xxx (2017) 1 e12 3
Please cite this article in press as: Heckmann, T., et al., Electrically conductive adhesives, thermally conductive adhesives and UV adhesives in
data extraction forensics, Digital Investigation (2017), http://dx.doi.org/10.1016/j.diin.2017.02.009

The challenge here is to reball the chip prior to chip-on. Dedi-
cated pump, such as NORDSON Performus II, could also be used for
this purpose as it allows to carefully choose time/pressure, key
parameters to create small, round and ready to be long term fixed
balls (see Fig. 9 ).
Prototyping
Prototyping is often required within digital forensic processes
either to create extraction environments (e.g. donor board, attack
board), either to understand exhibit modus operandi (e.g. reverse
engineering). Such prototypes often require expensive on-demand
design boards or adapters.
Polymer based adhesives properties (electrical/thermal con-
ductivity, insulation) can also be used as a cornerstone for home-
made prototype as demonstrated in the next use case section. In
fact, the adhesives are suitable to fix, connect or isolate parts of any
system in a very flexible and an affordable way.
Memory ( e·MMC) man-in-the-middle for inspecting, reading
and writing purposes
This used case is related to the need to understand security
mechanism of a smartphone which was archived by prototyping amemory man in the middle attack. The aim of the prototype is to
capture/analyse exchanges between the smartphones processor
and its non-volatile memory ( e$MMC) in order to be able to easily
manipulate (read/write) the memory data (see Fig. 10 ).
An Embedded MultiMediaCard ( e$MMC) is an advanced,
managed NAND flash memory for mobile applications (smart-
phone, tablets, GPS). The e$MMC is not only a NAND flash memory
but also a controller/interface circuit ( J. S. S. T. Association, 2010 e
Fig. 11 ).
Electrical components need to be electrically connected for
power, ground and signal transmissions. These interconnectiontechnologies can be: Pin Through Hole (PTH), Surface Mount
Technology (SMT), Ball Grid Array (BGA), Chip Scale Package (CSP)
and Flip Chip Technology (FCT).
In this paper, we will focus on the e$MCC BGA technology. Sig-
nals are transmitted through balls located between the component
and the board ( Fig. 12 ).
Then the bonding wires are used to make the junction between
the BGA balls and silicon dies ( Fig. 13 ).
The e$MMC, contrary to Universal Flash Storage (UFS),
7has a
parallel interface which means it can only send data in one direction
at a time: it can either be read or written, not both at the same time.
UFS has a Low-Voltage Differential Signaling (LVDS) serial
interface which have separately dedicated read/write paths. This
allows full two-way interaction: UFS can be read and written
simultaneously ( Fig. 14 ).
Our study is limited to the recovery of data in the e$MMC. As it is
described in the JEDEC Bus protocol, after a power-on reset, the
host must initialize the card by a special message-based Multi-
MediaCard bus protocol.
For each data lines, data can be transferred at the rate of one bit
SDR (single data rate) or two bits DDR (dual data rate) per clock
cycle (see Figs. 15 and 16 ).
The data bus is a flexible data bus of 1, 4 or 8 bits. In our study,
we use an H9DP4GG4JJMCGR HYNIX e$MMC. After power-up (or
hardware reset), only D0 is used for data transfers, but the host can
configure the device to use a wider data bus, D0, D0-D3 or D0-D7
for data transfer (see Fig. 17 ).
Our chip is packaged on a 153-balls BGA (0.5 mm pitch, 0.3 mm
diameter ball, lead and Halogen Free).
Let's be careful with the datasheet. Indeed even if the data sheet
indicates common beads value (VSS, Vdd) they may not be inter-
connected. So on the latest generation of e$MMC, the internal VSS
Fig. 7. Damaged micro-USB connector repair.
7http://www.jedec.org/sites/default/ files/docs/JESD220C.pdf .T. Heckmann et al. / Digital Investigation xxx (2017) 1 e12 4
Please cite this article in press as: Heckmann, T., et al., Electrically conductive adhesives, thermally conductive adhesives and UV adhesives in
data extraction forensics, Digital Investigation (2017), http://dx.doi.org/10.1016/j.diin.2017.02.009

are not connected to the external VSS. In order to write on the
e$MMC, it will be essential to link the internal and external VSS to
the ground, otherwise reading will be impossible (media write-
protected).
Thus, in our initially study we will only demonstrate the feasi-
bility, limiting itself to D0. So we need to develop a process to
capture the CMD, CLK, VSS, VCC (nand), VCCQ (DRAM), VDD(DRAM)and D0. These are compulsory to dry the memory. The signals will
be routed via an SD adapter.
Applied method: memory-man-in-the-middle
We now describe our new forensic chip reworking step process
using different adhesives properties. Our study focuses on the re-
Fig. 8. Pads restored.T. Heckmann et al. / Digital Investigation xxx (2017) 1 e12 5
Please cite this article in press as: Heckmann, T., et al., Electrically conductive adhesives, thermally conductive adhesives and UV adhesives in
data extraction forensics, Digital Investigation (2017), http://dx.doi.org/10.1016/j.diin.2017.02.009

working step of the e$MMC, but these steps can be used for other
BGA-components.
We hereby illustrate adhesives capacities by manufacturing a
memory man in the middle attack platform. This platform, previ-
ously announced in ( Heckmann et al., in press ), aims to provide
(reading/writing) access to data exchanged between the phone
controller and its non volatile memory ( Fig. 18 ).
The re-working process we used was realised in several steps, as
follow.
Step 1
Cleaning the receiver PCBs, using a cleaning soldering iron tip
(Fig. 19 ).Step 2
Reballing high temperature (250/C14C) of the PCB except the balls
we want to observe (CMD, CLK, VSS, VCC (nand), VCCQ (DRAM),
VDD (DRAM) and D0) ( Fig. 20 ).
Step 3
Deposit of electrical conductive adhesive glues using a micro
instrument on the balls we want to observe ( Fig. 21 ).
Step 4
Attaching cables to the electrical conductive adhesive deposits
during step 3 ( Fig. 22 ). The wires we use are copper wires. These are
isolated and have a section of 30 microns.
Step 5
Fixing wires with UV glue ( Fig. 23 ). The goal here is to prevent
the wires from interfering when positioning the e$MMC. Note: UV
adhesives cannot withstand the re-soldering temperatures. So the
only goal is to make instant and mouldable fixing cables. This glue
will allow insertion of the second adhesive (step 6), which will hold
the re flow temperature.
Step 6
Fixing wires between the balls by TCA ( Fig. 24 ). Here the setting
rate is longer than UVA's (step 5) but thermal conductive adhesive
will hold the temperature.
Step 7
Low temperature re-balling e$MMC using the technique
detailed in Heckmann et al. (in press) (Fig. 25 ).
Step 8
Deposit of the e$MMC on the PCB through the welding station
BGA. At this stage high temperature balls face low temperature
ones. Follows the application of the low temperature curve re-
soldering ( Fig. 26 ).
Fig. 9. NORDSON performus II pump.
Fig. 10. Memory man-in-the-middle prototype being prepared.
Fig. 11. e$MMC controller scheme eSource ( J. S. S. T. Association, 2010 ).
Fig. 12. 3D X ray tomography of the H9DP4GG4JJMCGR HYNIX e$MCC.T. Heckmann et al. / Digital Investigation xxx (2017) 1 e12 6
Please cite this article in press as: Heckmann, T., et al., Electrically conductive adhesives, thermally conductive adhesives and UV adhesives in
data extraction forensics, Digital Investigation (2017), http://dx.doi.org/10.1016/j.diin.2017.02.009

Step 9
Checking positioning via RX 2D ( Fig. 27 ).
Step 10
Lighting the reassembled phone ( Fig. 28 ) and manipulating the
data (reading of the e$MMC, re-injection of the modi fied data in the
e$MMC, telephone ignition, etc.).
Note that the real-time modi fication of data (e.g. data modi fi-
cations via script) wouldnt need to connect low and high temper-
ature balls but would need to connect each of them to an intrusive
piece of electronic (e.g. FPGA board).
Fig. 13. e$MMC decapsulated.
Fig. 14. e$MMC/UFS interface comparison eSource ( Samsung, 2015 ).
Fig. 15. Sequential read operation: 1 bit data bus.
Fig. 16. Sequential write operation: 1 bit data bus.
Fig. 17. Mapping schematic balls of the H9DP4GG4JJMCGR HYNIX e$MCC.
Fig. 18. Memory man in the middle using two levels of BGA.T. Heckmann et al. / Digital Investigation xxx (2017) 1 e12 7
Please cite this article in press as: Heckmann, T., et al., Electrically conductive adhesives, thermally conductive adhesives and UV adhesives in
data extraction forensics, Digital Investigation (2017), http://dx.doi.org/10.1016/j.diin.2017.02.009

Experimental results
Reading phase of e ·MMC
To read the e$MMC we connect our cables (io, …Vdd) to an SD
adapter. This adapter is connected to a write blocker (forensic
mode) as shown on Fig. 29 .
We connect the blocker to the computer via USB and use anal-
ysis software in order to extract the memory. Note that we need topower the phone via its USB port as the power provided to the
e$MMC via SD adapter is not enough (loss in the PCB).
Fig. 19. Cleaning the receiver PCBs.
Fig. 20. Reballing high temperature (250/C14C).
Fig. 21. Deposit of ECA.
Fig. 22. Attaching the isolated wires.
Fig. 23. Instantly fixing wires with UV glue.T. Heckmann et al. / Digital Investigation xxx (2017) 1 e12 8
Please cite this article in press as: Heckmann, T., et al., Electrically conductive adhesives, thermally conductive adhesives and UV adhesives in
data extraction forensics, Digital Investigation (2017), http://dx.doi.org/10.1016/j.diin.2017.02.009

Reinjection Phase in the e ·MCC
To inject the new image in the e$MMC we achieve the same
mounting as above but without the write blocker ( Fig. 30 ). The
power of the phone should always be done via USB. The injection is
performed correctly.
Tracking Signals Using a Logic Analyzer or an FPGA
As shown in picture 31, techniques using adhesives can enable
us to spy the exchange of information between the controller and
thee$MMC in real time. In our example, we listened only to IO0
because only this cable is de flected by the use of glue (see
Fig. 31 ).
Fig. 24. Fixing wires: TCA and UVA.
Fig. 25. Low temperature re-balling technique ( Heckmann et al., in press ).
Fig. 26. Using of the welding BGA station.T. Heckmann et al. / Digital Investigation xxx (2017) 1 e12 9
Please cite this article in press as: Heckmann, T., et al., Electrically conductive adhesives, thermally conductive adhesives and UV adhesives in
data extraction forensics, Digital Investigation (2017), http://dx.doi.org/10.1016/j.diin.2017.02.009

We can achieve this by drain on all IO and also perform this
operation on the CPU or RAM to characterise all exchanges in real
time.
TCA resistive tests
We tested the TCA and have thrust beyond its de-naturation
temperature. We have applied thereto a temperature of 500/C14C
for 10 min to see if the high temperature (at high temperature re-
welding) had an effect on the polymer chains (see Fig. 32 ).
Wefind that the polymer chains are unchanged but the TCA
turns into a kind of compact powder. Thus the mechanical prop-
erties of the adhesive are impaired.
Discussion
Board preparation
In some cases the first de-soldering necessary to achieve our
prototype can be made very dif ficult because of the presence of an
epoxy adhesive present between the e$MMC and the PCB.
This adhesive is a thermal conductor. This polymer is designed
to dissipate heat. Thus for a good de-soldering we need to increasethe heat a lot with the risk of damaging the PCB. In this case, we
recommend to lap out the memory (and any other paired compo-
nent) and then re-solder it (them) back on a donor board using our
adhesives techniques.
The donor board is obtained by milling the board to extract the
e$MMC (and any other paired component). In many cases, CPU
embeds a hardware key, which is essential to re-solder, at least, for
thee$MMC and the CPU.
Alternative solutions
An easier and affordable alternative would be to only consider
standard chip BGA grids and the memory reading/writing (not
Fig. 27. RX 2D of the welding e$MMC: Checking positioning.
Fig. 28. The prototype's general view.
Fig. 29. Reading phase of e$MMC.
Fig. 30. Reinjection Phase in the e$MMC.T. Heckmann et al. / Digital Investigation xxx (2017) 1 e12 10
Please cite this article in press as: Heckmann, T., et al., Electrically conductive adhesives, thermally conductive adhesives and UV adhesives in
data extraction forensics, Digital Investigation (2017), http://dx.doi.org/10.1016/j.diin.2017.02.009

spying or modifying traf fic), commercial adapters (such as Iron-
wood's ones8).
Our adhesive based technique is however more versatile and
straightforward. Moreover, a man-in-the-middle approach is much
more powerful as it allows live analysis and exchange or
manipulation.
Conclusion and further research
First results
At the time of writing this paper, two attacks were chosen
preferred in the forensic field for the reverse-engineering of secure
systems:
/C15Laser attacks and electric probing (chip-on)
/C15Welding and re-soldering attacks (chip off).
These two methods are very powerful. However, they quickly
become time consuming when the forensic investigator needs to
realise numerous changes of encrypted data or as to make several
change injections to characterise the secure system. So these two
methods are preferred in routine.
This study is dual. It first introduces the multiple properties of
adhesives (electrically conductive, thermally conductive andelectrically insulating curable by UV) and their concrete possibility
to solve signi ficant and long-standing hardware forensic chal-
lenges. Then the study successfully applies the adhesive capabilities
to propose a memory man in the middle platform. This platform
intends to provide advanced access to the inspected devices: easy
access to the memory content (reading/writing) but also data ex-
change live analysis and manipulation.
Future developments
The methods that we have presented allowed us to develop a
prototype for performing series of e$MMC reads and writes (when
the phone is switched off) without de-soldering the electronic
component for each reading.
The insertion of the electrical wires between the PCB and the
e$MMC is made possible by the use of different physical properties
of the adhesives.
With the memory-man-in-the-middle possibility and interest
being proven, we now aim to expend it to more complex devices.
We are currently working on platforms on which many lines are
processed and can be fully manipulated (i.e devices in which pro-
cessor and memory pads are not hard-connected).
Acknowledgements
The authors would like to thank the proofreaders, especially
Sebastien Lepeer, Antoine Devemy and Natacha Laniado, for theirsupport and contribution to this article.
References
Asif, A., Shi, W., Shen, X., Nie, K., 2005. Physical and thermal properties of {UV}
curable waterborne polyurethane dispersions incorporating hyperbranchedaliphatic polyester of varying generation number. Polymer 46 (24),
11066 e11078. http://dx.doi.org/10.1016/j.polymer.2005.09.046 .http://www.
sciencedirect.com/science/article/pii/S0032386105013790 .
Breeuwsma, M., De Jongh, M., Klaver, C., Van Der Knijff, R., Roeloffs, M., 2007.
Forensic data recovery from flash memory. Small Scale Digit. Device Forensics J.
1 (1), 1 e17.
Cui, H.-W., Li, D.-S., Fan, Q., Lai, H.-X., 2013. Electrical and mechanical properties of
electrically conductive adhesives from epoxy, micro-silver flakes, and nano-
hexagonal boron nitride particles after humid and thermal aging. Int. J.
Adhes. Adhes. 44, 232 e236. http://dx.doi.org/10.1016/j.ijadhadh.2013.03.007 .
http://www.sciencedirect.com/science/article/pii/S0143749613000626 .
Cui, H.-W., Fan, Q., Li, D.-S., 2014. Surface functionalization of micro silver flakes and
their application in electrically conductive adhesives for electronic package. Int.
J. Adhes. Adhes. 48, 177 e182. http://dx.doi.org/10.1016/j.ijadhadh.2013.09.036 .
http://www.sciencedirect.com/science/article/pii/S0143749613001747 .
Falat, T., Wymysowski, A., Kolbe, J., 2007. Numerical approach to characterization of
thermally conductive adhesives. Microelectron. Reliab. 47 (2 e3), 342 e346.
http://dx.doi.org/10.1016/j.microrel.2006.02.019 . http://www.sciencedirect.
com/science/article/pii/S0026271406000710 .
Felba, J., 2011. 2-thermally conductive adhesives in electronics. In: Alam, M.,
Bailey, C. (Eds.), Advanced Adhesives in Electronics, Woodhead Publishing Se-
ries in Electronic and Optical Materials. Woodhead Publishing, pp. 15 e52.
http://dx.doi.org/10.1533/9780857092892.1.15 .http://www.sciencedirect.com/
science/article/pii/B9781845695767500027 .
Heckmann, Th., Souvignet, Th., Lepeer, S., Naccache, D., December 2016. Low-
temperature low-cost 58 bismuth – 42 tin alloy forensic chip re-balling and
re-soldering. Digit. Investig. 19 http://dx.doi.org/10.1016/j.diin.2016.10.003 .
J. S. S. T. Association, March 2010. Jedec standard, embedded multimediacard(e-
mmc) e-mmc/card product standard, high capacity, including reliable write,boot, sleep modes, dual data rate, multiple partitions supports, security
enhancement, background operation and high priority interrupt (mmca, 4.41).
JEDEC Solid State Technology Association 2010 .
Jongh, M.D., 2014. Embedded Update 2014, Prague ENFSI FITWG Annual Meeting .
K i m ,J . K . ,K i m ,W . H . ,L e e ,D . H . ,2 0 0 2 .A d h e s i o np r o p e r t i e so f{ U V }c r o s s l i n k e d
polystyrene-block-polybutadiene-block-polystyrene copolymer and tacki-
fier mixture. Polymer 43 (18), 5005 e5010. http://dx.doi.org/10.1016/
S0032-3861(02)00327-0 .http://www.sciencedirect.com/science/article/
pii/S0032386102003270 .
Kishi, H., Tanaka, S., Nakashima, Y., Saruwatari, T., 2016. Self-assembled three-
dimensional structure of epoxy/polyethersulphone/silver adhesives with electrical
conductivity. Polymer 82, 93 e99.http://dx.doi.org/10.1016/j.polymer.2015.11.043 .
http://www.sciencedirect.com/science/article/pii/S003 2386115303992 .
Fig. 32. TCA tested beyond its de-naturation temperature.
Fig. 31. Tracking Signals Using a Logic Analyzer or an FPGA.
8Giga-snaP BGA SMT Adapters ehttp://souvignet.net/r/ts1th9z .T. Heckmann et al. / Digital Investigation xxx (2017) 1 e12 11
Please cite this article in press as: Heckmann, T., et al., Electrically conductive adhesives, thermally conductive adhesives and UV adhesives in
data extraction forensics, Digital Investigation (2017), http://dx.doi.org/10.1016/j.diin.2017.02.009

Li, Y., Wong, C., 2006. Recent advances of conductive adhesives as a lead-free
alternative in electronic packaging: materials, processing, reliability and ap-
plications. Mater. Sci. Eng. R Rep. 51 (1), 1 e35.
Li, Y., Wong, C., 2006. Recent advances of conductive adhesives as a lead-free
alternative in electronic packaging: materials, processing, reliability and
a p p l i c a t i o n s .M a t e r .S c i .E n g .RR e p .5 1( 1 e3), 1 e35. http://dx.doi.org/
10.1016/j.mser.2006.01.001 .http://www.sciencedirect.com/science/article/
pii/S0927796X06000131 .
Luo, J., Cheng, Z., Li, C., Wang, L., Yu, C., Zhao, Y., Chen, M., Li, Q., Yao, Y., 2016.
Electrically conductive adhesives based on thermoplastic polyurethane filled
with silver flakes and carbon nanotubes. Compos. Sci. Technol. 129, 191 e197.
http://dx.doi.org/10.1016/j.compscitech.2016.04.026 .http://www.sciencedirect.
com/science/article/pii/S0266353816301658 .
Miao, H.-W., Duh, J.-G., 2001. Microstructure evolution in sn ebi and sn ebiecu
solder joints under thermal aging. Mater. Chem. Phys. 71 (3), 255 e271.
Mishra, S., Singh, N.K., Rousseau, V., 2016. Chapter 7-memory interfaces. In:
Mishra, S., Singh, N.K., Rousseau, V. (Eds.), System on Chip Interfaces for Low
Power Design. Morgan Kaufmann, pp. 275 e305. http://dx.doi.org/10.1016/
B978-0-12-801630-5.00007-4 .http://www.sciencedirect.com/science/article/
pii/B9780128016305000074 .Moon, S.-H., Swearingen, S., Foster, M.D., 2004. Scanning probe microscopy study of
dynamic adhesion behavior of polymer adhesive blends. Polymer 45 (17),
5951 e5959. http://dx.doi.org/10.1016/j.polymer.2004.06.023 .http://www.
sciencedirect.com/science/article/pii/S0032386104005968 .
Puttlitz, K.J., Stalter, K.A., 2004. Handbook of Lead-free Solder Technology for Mi-
croelectronic Assemblies. CRC Press .
Rechchach, M., December 2011. Etude thermodynamique des syst /C18emes ternaires in-
sn-zn, bi-sn-cu et bi-sn-ni comme mat /C19eriaux pour soudre sans plomb (PhD.
thesis) .
Samsung, February 2015. emmc to ufs: How nand Memory for Mobile Products Is
Evolving. https://news.samsung.com/global/emmc-to-ufs-how-nand-memory-
for-mobile-products-is-evolving .
Zhang, Z., Luo, S., Wong, C., 2013. Flip chip under fill: materials, process, and reli-
ability. In: Advanced Flip Chip Packaging. Springer, pp. 155 e199.
Zhang, J., Zivic, N., Dumur, F., Xiao, P., Graff, B., Fouassier, J.P., Gigmes, D., Laleve, J.,
2014. Uv-violet-blue {LED} induced polymerizations: speci fic photoinitiating
systems at 365, 385, 395 and 405 nm. Polymer 55 (26), 6641 e6648. http://
dx.doi.org/10.1016/j.polymer.2014.11.002 . http://www.sciencedirect.com/
science/article/pii/S0032386114010143 .T. Heckmann et al. / Digital Investigation xxx (2017) 1 e12 12
Please cite this article in press as: Heckmann, T., et al., Electrically conductive adhesives, thermally conductive adhesives and UV adhesives in
data extraction forensics, Digital Investigation (2017), http://dx.doi.org/10.1016/j.diin.2017.02.009