Forensic laboratories are frequently subjected to mobile devices that are assailed by shock or forced damage which might be the result of intentional efforts to destroy proof from the devices or accidental exposure. Chip-off technique is an effective method for data retrieval from such kind of exhibits. However, nowadays all mobiles phones are securely encrypted with full disk encryption (FDE) or file-based encryption (FBE) which makes chip-off forensics an improbable process to successfully retrieve data. In many of these cases, the encryption is on the hardware and hence, the device could be successfully decrypted by bringing it in its original condition. Thus, the original user data can be obtained for investigative purposes. This process can be enabled by replacement of electronic parts of the original device which contains user data and decryption keys i.e. PCB to the new host. This research paper covers a case study of a mobile phone obtained in broken and shattered condition whose diagnosis of PCB and subsequent actions led to data recovery.

The digital world is dominated and ruled by the IOS and Android operating systems on mobile as well as tablet platforms. Together they share a whopping 99% (till 2021) of the share market. The Windows Phones (WP) are occupants of that less than 1% platform that they share with other subsidiary operating systems. Due to the lack of commercial popularity and production of such Windows devices, the process of data extraction and analysis of such devices is unique and challenging for forensic experts. The standard forensic data retrieving software and hardware do not support advanced requisition techniques except the direct extraction. Thus, in cases with locked WP devices, the software/ hardware is unable to support the device’s physical extraction or lock bypass facility. As observed in several digital cases, these portable devices contain details of an individual’s most private life including communications, contacts, browsing history, and location specifics at any given time. Although the operating systems of Microsoft and Windows mobile devices are similar in certain ways, specialized skill sets and tools are required while dealing with location, examination, and interpretation of the digital evidence on these systems. In this research paper, the authors are discussing the reliability and success of data extraction of a Windows mobile device from IC/eMMC using specialized hardware/software with the Windows device.