AI 中文总结
该研究提出基于SEM的CrashScan方法，可从严重损坏的汽车SRS模块EEPROM中100%恢复EDR数据，填补了相关取证数据恢复方案的空白，可惠及多行业。
AI 中文摘要
本文介绍了一种完全可行且成本合理的方法，用于在汽车SRS（安全气囊控制）模块的数据存储内存芯片发生永久故障后从中恢复数据。研究人员从一个真实的SRS模块中以100%的成功率提取了所有必要信息，该模块经历了严重事故，导致其处理器和Flash EEPROM芯片均遭受电气损坏，封装上可见孔洞。进一步调查显示，损坏很可能由过电压及随后流过芯片硅片的大电流造成，这不仅导致部分内部金属线熔化和蒸发，还导致硅衬底部分蒸发，形成的空腔被键合线的熔化金填充，这表明故障性质是局部温度超过3000°C。尽管片上EEPROM阵列距离损坏区域仅几百微米，但它未丢失任何单个比特的信息，这证明该方法未来可成功用于从严重损坏的设备中恢复数据。使用包含恢复数据的 donor单元，研究人员使用Collision Sciences CrashScan进行了标准台式EDR提取，生成了完整的EDR报告。本文呈现并讨论了恢复数据的取证意义、方法的技术新颖性以及完整的事故重建。此前，若因事故导致内存芯片损坏，尚无可行或成本合理的完整数据提取或恢复解决方案。通过使用创新且专有的样品制备和成像技术，现在可以在芯片遭受永久机械、电气或火灾损坏后提取并验证其中存储的所有数据，这不仅有助于汽车行业，还能惠及医疗、航空和航天工业。
英文摘要
This paper introduces fully working and affordable approach to data recovery from automotive SRS (airbag control) module after permanent failure of its data storage memory chip. All essential information was successfully extracted with 100% success rate from a real SRS module after severe accident which resulted in both its Processor and Flash EEPROM chip electrically damaged with visible holes in their packages. Further investigation revealed that the damage was likely caused by overvoltage and subsequent high-current-flow through silicon die of chips. This not only caused some internal metal wires to melt and evaporate but also caused partial evaporation of silicon substrate and the created cavity was filled with melted gold from a bonding wire. This reveals the nature of the failure with local temperatures exceeding 3000°C. Despite to the fact that the on-chip EEPROM array was only a few hundred micrometers away from the damaged area, it did not lose any single bit of information. This proved the approach to be resilient for successful data recovery from severely damaged devices in the future. With the donor unit containing the recovered data, standard bench-top EDR extraction was performed using Collision Sciences CrashScan, yielding a full EDR report. The forensic significance of the recovered data, the technical novelty of the methodology, and the complete accident reconstruction are presented and discussed. Until now, if because of an accident the memory chip was damaged, there was no feasible or affordable solution for full data extraction or recovery. With the use of innovative and proprietary sample preparation and imaging techniques, it became possible to extract and verify all the data stored inside chips after permanent mechanical, electrical or fire damage. This could help not only automotive but also medical, aviation and aerospace industries.
Comments11 pages, 19 figures, 3 tables
