Possessing a device is no longer necessarily sufficient to access the data required for digital investigations. Smartphones, cryptocurrency wallets, storage devices, and embedded systems may allow a team to identify the device and examine part of its software environment, while files, communications, or transaction records remain protected by mechanisms operating at the hardware layer.
This is the central idea in an article written by Marc Witteman, Thomas Ostrowski, and Craig Mackson and published by Semiconductor Engineering. The text notes that secure boot, the Secure Element, the Trusted Execution Environment (TEE), encrypted storage, and other hardware-backed protections can determine how a device starts, how access is authorized, and which components can access protected data.
What Changes in a Digital Investigation?
Traditional investigations often begin with the operating system, file system, backups, or available application interfaces. But when the required information is behind a barrier enforced by a chip or security component, the question is no longer limited to how to extract the data. The team must first determine what prevents access, where the protection mechanism is implemented, and whether there is a technically viable path for examining it.
Device schematics, source code, or engineering documentation may not be available, particularly if the device is seized, proprietary, outdated, or designed to resist unauthorized access. The article therefore proposes characterizing the device directly by identifying its important components, examining its available interfaces, monitoring its behavior during security-sensitive operations, and attempting to determine which components control access. This characterization is not intended to analyze every part of the device, but to identify the mechanism separating the investigator from the data relevant to the case.
Two Tools When a Deeper Layer Is Needed
The article mentions Side-Channel Analysis and Fault Injection as two possible techniques in advanced investigations. Side-channel analysis measures physical signals emitted while the device performs a particular operation and may reveal internal activity that does not appear through ordinary software interfaces.
Fault injection, meanwhile, involves causing a controlled disturbance while the device is operating to determine whether a specific security process can be influenced. The text emphasizes that the choice of technique should follow the type of device, the protection mechanism, and the information the team is attempting to access. The channels that can be studied include timing, power, electromagnetic emissions, and light, with each channel’s suitability varying according to accessibility and the level of protection.
The article notes, for example, that examining electromagnetic emissions may help study the type of encryption or how it is implemented without making physical modifications, while researchers might use an appropriate timing disturbance to test a password-verification process. These are sensitive technical examples and should therefore be conducted only within legal authority and controlled, reproducible forensic procedures.
How Is the Appropriate Capability Built?
Hardware security testing should not become a goal separate from the investigation. The objective remains to access information connected to the case while preserving evidence integrity, documenting the steps, and ensuring that the results can be reproduced. For this reason, the article suggests that organizations assess practical questions before establishing an in-house laboratory, including: the number of investigations in which access to a protected device was obstructed, the types of devices that are most difficult, the information usually required, the expertise and equipment available, and what needs to be performed internally or can be assigned to specialized organizations.
Developing internal expertise may make more sense for organizations that frequently handle protected phones, cryptocurrency wallets, embedded systems, or custom electronics. Less frequent cases, however, may call for engaging external experts rather than building a large laboratory disproportionate to the level of need.
Why Does This Matter?
The actual shift here is that part of digital forensic investigation is moving from extracting data through software to understanding the physical protection mechanisms that control access to it. This expands the range of skills required by laboratories, but it does not establish that every protected device can be compromised or that every technique will produce admissible evidence. The result depends on the device’s design, the ability to access its components, the type of protection, the legal constraints, and the integrity of the methodology.
It is worth noting that the article was published in sponsored-blog format, and that its authors are affiliated with Keysight Technologies, which the text says provides tools, laboratories, and training for forensic teams. The article therefore offers a useful framework for determining needs, but it does not constitute an independent assessment of the performance of particular tools, nor does it present documented test results for a specific device or case.