Semi-invasive logic state imaging of SRAM cells via optical analysis has been demonstrated to be a powerful attack vector on advanced ICs. Reported applications tend to focus on the recovery of small size secrets such as encryption keys. However, the emergence of new cryptographic algorithms with encryption keys or other assets of larger size makes manual approach challenging. In this manuscript, a framework for the automated estimation of bitcell data is developed. It focuses on understanding signal generation and detection processes to assess viability of well-established classification and clustering algorithms. A main advantage of such an approach is that it makes optical attacks for large scale recovery more feasible since limited to no training data is required. The approach is evaluated on a dataset generated under Thermal Laser Stimulation on a commercial SoC-FPGA manufactured in 28 nm technology.

Floating gate-based flash memory is a widely used storage medium for sensitive data that may be relevant to forensic investigations. For various data extraction techniques, the accuracy of the recovered data is critical to ensuring the integrity of information as forensic evidence. In cases where the devices are physically or digitally damaged, invasive data extraction techniques serve as a last resort, and can directly extract binary from individual memory cells. Here we introduce a new invasive data extraction technique called selective chemical engraving. This electrochemical-based approach could systematically imprint the data of ‘0’ and ‘1’ as cavities on memory surfaces, which can subsequently be imaged with an optical microscope and SEM. This technique is capable of extracting data stored in embedded flash memory in microcontrollers of 40 nm technology node with a high accuracy of 99.66%. The error correction code (ECC) stored in the flash memory was also extracted together with the data. By analysing the extracted ECC, we were able to accurately derive the error correction algorithm of single error correction-double error detection (SEC-DED). The reconstructed SEC-DED code was then used to correct all 0.34% of errors. The high data retrieval accuracy (99.66%) together with the error correction capability led to a 100% accuracy of recovered data. This selective chemical engraving approach offers a comprehensive solution for the lowest-level data retrieval and correction from 40 nm technology flash memory, providing a new avenue for forensic data extraction.

Embedded Non-Volatile-Memory (NVM) such as Flash or EEPROM is a key component in modern microcontroller units. For instance, it can be used to store critical information such as user passwords or device firmware. Although several studies reported ways to extract binary data from embedded EEPROM bitcells, data organization has received less attention. In this paper, we present a method to identify bitcells organization in the EEPROM array. It relies on a combination of various laser-based techniques. The method was applied to an 8 bits AVR microcontroller.

A new data retrieval approach utilizing selective staining is explored to differentiate “0” from “1” cells in EEPROM and Flash memory with node sizes of 40 nm and 250 nm. A two-step staining process based on selective oxide etching and copper galvanic displacement deposition is introduced. The underlying mechanism is attributed to the difference in electric field across the tunnel oxide, which originates from the presence or absence of charges stored in the floating gates. With proper sample preparation, the selectively stained and non-stained cells can be characterized with optical microscopy and scanning electron microscopy, to facilitate direct read-out of data in a time-efficient manner. The physical layout of individual memory cells with respect to the stored data is identified. A systematic data retrieval is achieved with an accuracy of 95% at individual bit level. This selective staining technique marks the data permanently on the chip that allows for subsequent analysis and evidence retention.