Memory Carving in Embedded Devices: Separate the Wheat from the Chaff

Thomas Gougeon (1, 2) , Morgan Barbier (1) , Patrick Lacharme (1) , Gildas Avoine (2, 3, 4) , Christophe Rosenberger (1)

1 Equipe SAFE - Laboratoire GREYC - UMR6072
2 EMSEC - EMbedded SEcurity and Cryptography
3 INSA Rennes - Institut National des Sciences Appliquées - Rennes
4 IUF - Institut universitaire de France

Embedded devices usually gather and store personal data about the behaviours of their holders. For example, a public transportation card may record the last trips of the passenger, or a car ignition key may store the fuel consumption and the average engine speed of the vehicle. Being able to interpret these raw data without the knowledge of the specifications can be useful to establish digital evidence, for example in connection with criminal investigations. This paper investigates memory carving techniques for embedded devices. Given that cryptographic material in memory dumps makes carving techniques inefficient, we introduce a methodology to distinguish meaningful information from cryptographic material in small-sized memory dumps. The proposed methodology uses an adaptive boosting technique with statistical tests. Experimented on EMV cards, the methodology reaches a successful recognition rate greater than 99.8%.

Mots clés: forensics; memory carving; randomness; embedded devices; smart-cards; privacy

Domaines: Cryptographie et sécurité [cs.CR]

Thomas Gougeon, Morgan Barbier, Patrick Lacharme, Gildas Avoine, Christophe Rosenberger. Memory Carving in Embedded Devices: Separate the Wheat from the Chaff. International Conference on Applied Cryptography (ACNS), Jun 2016, Guilford, United Kingdom. ⟨10.1007/978-3-319-39555-5_32⟩. ⟨hal-01338109v1⟩