Memory Carving in Embedded Devices: Separate the Wheat from the Chaff

Thomas Gougeon (1, 2) , Morgan Barbier (1) , Patrick Lacharme (1) , Gildas Avoine (2, 3, 4) , Christophe Rosenberger (1)

1 Equipe SAFE - Laboratoire GREYC - UMR6072
2 EMSEC - EMbedded SEcurity and Cryptography
3 INSA Rennes - Institut National des Sciences Appliquées - Rennes
4 IUF - Institut universitaire de France

This paper investigates memory carving techniques for embedded devices. Given that cryptographic material in memory dumps makes carving techniques inefficient, we introduce a methodology to distinguish meaningful information from cryptographic material in smallsized memory dumps. The proposed methodology uses an adaptive boosting technique with statistical tests. Experimented on EMV cards, the methodology recognized 92% of meaningful information and 98% of cryptographic material.

Mots clés: forensics; memory carving; randomness; embedded devices; smart-cards; privacy

Domaines: Cryptographie et sécurité [cs.CR]

Thomas Gougeon, Morgan Barbier, Patrick Lacharme, Gildas Avoine, Christophe Rosenberger. Memory Carving in Embedded Devices: Separate the Wheat from the Chaff. 14th International Conference on Applied Cryptography and Network Security (ACNS 2016), Jun 2016, Guilford, United Kingdom. ⟨10.1007/978-3-319-39555-5_32⟩. ⟨hal-01338109v2⟩