Car Camera Forensics

so basically there are 2 different navigation units available for Land Cruiser, one was to be used before 2013 models and one after 2013 models.

To have a look at the navigation unit used before 2013
http//s3.postimg.org/7lbyppucz/IMG_0354edited.jpg

Yep, and that is "local" (another reason to be very specific).
That unit is a nsca-w09g Avalon (made by Aisin AW) whilst - as an example and AFAIK - in the US the navigation system is a Fujutsu Ten (Eclipse).

I noticed there was not NAND chip or Hard drive or any storage mechanism, the person has confirmed that the navigation works from the SD card pointed in the picture and thats it.

This is "strange", there should be at least a flash for the initial boot, if you prefer for the "firmware" of the unit (though it won't contain any useful data).

jaclaz

Looking at the last image, those two ICs do not look like NAND chips.

I could be totally wrong, but I do not think they are because of the packaging (shape of the case, leg placement and leg count), location on the PCB, and the surrounding items.

Now, behind the left arrow (exactly where tip ends) there is a rectangular shaped IC with a white sticker on it - that might be an EEPROM, and remotly possible, a NAND.

The one on the left of that, also with a white sticker might be a NAND, or more likely a uDiskOnChip or similar.

A top down picture would be awesome. Now I am going to spend endless hours to verify my above conjecture.

@Jaclaz

Yeah there are fitted in here locally in "middle east" hence a different type of that availaable in the US, regarding the firmware , its all read from the external protected SD CARD.

For privacy laws in our country storage media' are unavailable in the Navigation unit so people cannot be tracked. - how true is that ( we all don't know).

@jhup you could be possibly right, even if not it all throws us to conclution that we need to get our hands dirty to have an aquitiion with the "chip off" methods.

What are the best NAND chip readers?

Yeah there are fitted in here locally in "middle east" hence a different type of that availaable in the US, regarding the firmware , its all read from the external protected SD CARD.

As said "strange".
The message "insert card SD"
http//au.toyotaownersclub.com/forums/topic/27885-help-with-aurion-2010-maps-sd/
must be written somewhere, and as well a - as basic as it can be - "BIOS" or bootloader for the SD Card must exist, and it would be "queer" if nowadays (last few years) it was not in a flash chip (i.e. upgradable).
I mean, even the stupidest CD/DVD "burners" have flashable firmware since several years, though as said it won't contain anything of use for an investigation.

jaclaz

I asked early on why chip-off because it should be almost the last resort. It destroys the evidence. There is no way to "image" the physical evidence into an essentially duplicate physical evidence.

I would first explore any and all possibilities of some test-access-point solution (JTAG, I2C, SPI, UART, etc.). I would be surprised if there was no such points on high volume production electronic device.

But, if you insist to do chip off, the answer to your question is "yes".

First, figure out the packaging.

What would you do if the chip is stacked, that is two ICs sandwiched together? Let's say it is BGA and not stacked (which is misleading because there are many BGA types, and there are many BGA configurations).

Now you need to get the data sheet on it to figure pin out, voltage, signaling, etc.

Is the numbering intact on the casing? Many vendors remove it. What will you do if it is an FPGA? You might get the data sheet but it will not tell you how the final user configured it. How about if it is an ASIC? Companies are going into non-fab design because it is much cheaper to get something specific, then have a fab print just enough - plus competitors have to reverse engineer the chip itself to understand. If we are talking about non-volatile memory, is it really NAND, or NOR or . . .?

Let's pretend that you got the chip off, figured out the packaging, found the data sheet. Now it needs mounted, where it can be connected to some power and data channels.

You can mount it on some Schmartboard, pogo-stick clamp, solder hair thin gold wires or any other variety of methods.

The chip is now mounted and let's pretend it is also connected to your computer. Now you need to communicate with it, without modifying the data.

Finally, whatever data is collected, it needs to be interpreted.

Is it always this hard? Of course not, but the point is your first few are going to be this hard. Some of the headaches are most likely reduced as most vendors use "standard" non-volatile memory.

(this is getting a bit long so now just the steps)

Finding a communication port removes about two thirds of the above headaches.

Yes, I painted an almost worse case scenario. Otherwise, it is cakewalk.

Search eBay for "BGA adapter", or whatever the packaging type is of your target IC.

You can take a look at ironwoodelectronics.com and advanced.com for more solutions and costs.

[…]
@jhup you could be possibly right, even if not it all throws us to conclution that we need to get our hands dirty to have an aquitiion with the "chip off" methods.

What are the best NAND chip readers?

I second jhup, most likely not NAND chips. Shame we don't have a shot of the board outside of the box.

Just to throw my $0.02 in, we've done some analysis on in-dash systems as well. Usually the storage devices are brought to us (we don't pull them, so I couldn't tell you where they store them), and I believe they've been from Ford or similar quality vehicles. But ours have been spinning hard drives. To throw a wrench into the whole thing though, the ones we've seen were locked, so we needed to use some firmware altering tools to unlock them to access their contents.