Here is the abstract you requested from the IMAPS_2016 technical program page. This is the original abstract submitted by the author. Any changes to the technical content of the final manuscript published by IMAPS or the presentation that is given during the event is done by the author, not IMAPS.
|Fire Damage and Repair Techniques for Flash Memory Modules: Implications for Post Crash Investigations|
|Keywords: forensic analysis, data recovery, device repair|
|As part of the investigation of accidents in mass transit, air travel in particular, the National Transportation Safety Board retrieves electronic devices from the crash scene. Analysis of the flash memory drives from these devices can provide clues as to the events leading to the crash. Unfortunately, the flash memory often is badly damaged and may not be readable. This study was undertaken in order to address two issues: (1) how much damage the device can sustain before it becomes completely unreadable, (2) what repair techniques can be employed in order to retrieve information from damaged memory units. The effect of thermal damage was investigated by subjecting flash memory modules to high temperature for three hours. Memory modules were found to be readable after exposure of up to 300⁰C for three hours. Small fissures evident in the overmold indicated thermal damage to the plastic, yet the chip retained the information written to it. Fissures of this type have been observed in actual parts retrieved from crash sites. However, a perfect replication of the overmold damage was not achieved. Above 300⁰C, the organic material was disintegrated, leaving only the die and metal circuitry. Despite the intense heat that can be realized in a post crash fire, surviving memory modules do not appear to suffer temperatures in excess of 300⁰C. Repair techniques were investigated by decapsulating the module, then purposely breaking the interconnecting wire bonds. The broken wire bonds were reconnected with metallic ink deposited by a precision printer. After the repairs, the modules were read with no errors, indicating a successful repair. Decapsulation was achieved in several ways, including acid etch, laser etch, plasma etch, and mechanical polish. Data integrity was retained through each of these decapsulation techniques, except for the acid etch. The plasma etch was run with a feed gas composition of 30% CF4, 70% O2 with a DC bias of 1130 V. Given the high voltage, it was surprising that the memory module retained the data integrity. This may be attributed to the I/O pins all being electrically common by the sample stage. Plasma etch, was not effective in decapsulation owing to the low etch rate. Mechanical polish proved to be the simplest decapsulation technique. Bonded interconnect wires were exposed by grind/polish of the memory module surface. Wires were “broken” by over polishing the sample. After confirming that the module could not be read, the repair was completed by printing the connections directly on the polished surface of the module. Reading the data confirmed a successful repair. Of the decapsulation techniques employed, the most effective was the laser etch. This method allowed local overmold removal, a desirable feature when dealing when relatively few circuit lines need to be repaired. After the local removal of overmold, the wires were broken with a Nordson Dage wire bond tester, which was also used to reposition the wires for the final repair. Repair was continued by using a low viscosity epoxy to re-establish the dielectric around the unbroken wires. Reconnection of the broken wires was done by printing a conductive ink between the wire nubs protruding above the epoxy surface.|
|Preeth Sivakumar, Research Assistant