# Memory carving can finally unveil your embedded personal data

Thomas Gougeon, Morgan Barbier, Patrick Lacharme, Gildas Avoine, Christophe Rosenberger

► To cite this version:

Thomas Gougeon, Morgan Barbier, Patrick Lacharme, Gildas Avoine, Christophe Rosenberger. Memory carving can finally unveil your embedded personal data. 12th International Conference on Availability, Reliability and Security (ARES), Aug 2017, Reggio di calabria, Italy. pp.1-9, 10.1145/3098954.3098978. hal-01615205

HAL Id: hal-01615205

https://hal.science/hal-01615205v1

Submitted on 15 Apr 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
# Memory carving can finally unveil your embedded personal data

Thomas Gougeon

Normandie Universite,
ENSICAEN-UNICAEN-CNRS,
GREYC UMR 6072
Caen, France F-14032

Morgan Barbier

Normandie Universite,
ENSICAEN-UNICAEN-CNRS,
GREYC UMR 6072
Caen, France F-14032

Patrick Lacharme

Normandie Universite,
ENSICAEN-UNICAEN-CNRS,
GREYC UMR 6072
Caen, France F-14032

Gildas Avoine

INSA Rennes, IRISA, IUF
Rennes, France

Christophe Rosenberger

Normandie Universite,
ENSICAEN-UNICAEN-CNRS,
GREYC UMR 6072
Caen, France F-14032

## ABSTRACT

Smart cards are involved in most of activities, and they gather and record plenty of personal data. A manual interpretation of these raw data is difficult without specifications. This task becomes really tedious applied to plenty of devices. The paper introduces the first method to automatically retrieve textual information from memory dumps of smart cards. Given the data structure and encoding are assumed to be unknown, the method is based on text statistics and characteristics of smart cards to discard false positives. The experiments performed on more than 350 memory dumps revealed that the method can automatically retrieve more than 99% of textual information available in a dump, while keeping the false positive rate as low as 5.5%.

## CCS CONCEPTS

* Applied computing Investigation techniques; System forensics;

## KEYWORDS

Forensics, memory carving, smart cards, binary analysis

## ACM Reference format:

Thomas Gougeon, Morgan Barbier, Patrick Lacharme, Gildas Avoine, and Christophe Rosenberger. 2017. Memory carving can finally unveil your embedded personal data. In *Proceedings of ARES '17, Reggio Calabria, Italy, August 29-September 01, 2017*, 9 pages.
https://doi.org/10.1145/3098954.3098978

## 1 INTRODUCTION

Smart cards usually gather and store personal data, possibly related to the behaviour of their holder. They are typically low-cost devices including (but not limited to) credit cards, mass transportation passes, electronic passports, keyless entry and

start systems, and ski passes. In most cases, the personal data contained in these devices are accessible without requiring any authentication. For example, the Mobib card contains sensitive data, including holder's name, zip code, and native language [7]. Interpreting the meaning of the captured data is difficult and time-consuming when neither the data structure nor the data en-coding are known, particularly if the number of devices is large. So far, it does not exist any adapted method to automatically retrieve information stored in these devices, whereas there is really a need for a generic method investigating these devices. This kind of investigation is involved in several scenarios: (i) to establish digital evidence in connection with criminal inves-tigations, (ii) to retrieve information about a missing person, or (iii) to verify whether a system complies with the claims of manufacturer or authority. Textual information that can be retrieved in smart cards includes first and family names, postal and email addresses, corporate names, cities and countries, etc.

Nevertheless, the function used to encode the information is unknown. Worse than that, several encoding functions may have been used to encode different data fields in a given dump. Given the length and the position of the information in the dump are unknown (information is not necessarily byte-aligned), applying a decoding function on a dump generates hundreds of strings. As a consequence, a decoding process testing all possible decoding functions outputs an unmanageable number of non-information. Indeed, a non-information appears when a bit sequence in a dump is decoded with a function that is different from the one used to encode it. An automatic process to discard (most of) the non-information is therefore needed. A human decision can be considered afterwards to eliminate the few remaining non-information.

This paper introduces the first automatic method that retrieves the textual information stored in dumps obtained from non-volatile memory of smart cards. Up to our knowledge, it is the first paper that investigates the automatic interpretation of data in these dumps. The method addresses dumps where
the data is not encrypted or obfuscated, which is the case with
most smart cards. The method consists of a three-step process
that combines lexical, syntactic, and multi-dump analyses. We
applied our method without the multi-dump analysis, on more
than 350 dumps from around 50 real-life applications, retriev-
ing more than 99% of textual information stored in the dumps
and eliminating about 95% of the non-information generated
by the lexical analysis. Applying the multi-dump analysis on
25 sets of dumps from different applications reduces by 55%
the number of non-information returned by the method.

The paper is structured as follows. Section 2 introduces the context with two dump examples, related works, and the proposed method. Section 3 explains the lexical analysis generating strings from the raw data, and Section 4 presents the syntactic analysis eliminating non-information with a Bayesian classifier. Experiments, metrics, and results without the multi-dump analysis are described in Section 5 while the multi-dump analysis is introduced in Section 6 along with the experimental results.

2 PROPOSED METHOD

2.1 Context

We provide details on two dumps extracted from credit cards (EMV) and public transportation cards (Calypso). The dumps contain elementary files that have been retrieved using the cards' APIs. The files are made of *records*, and the information is contained in (non-necessarily contiguous) *fields*, e.g., holder's name, holder's birthdate, etc.

Figure 1 is a (partial) anonymised dump of a credit card com-
pliant with the EMV specifications [8]. Each line annotated
with a number represents a record. The underlined sequence
of the first record represents the words “Transaction CB” en-
coded using ASCII. The underlined sequences of the second
record represents the words “Visa” (×2) and “Debit” encoded
also using ASCII. The underlined sequence of the 5th record
represents the *CardHolder Name* of the credit card, “Mr John
Smith”, encoded using ASCII.

The EMV card contains plenty of information in addition
to these textual information. For example, the record 6 stores
the date, the location, and the amount of the last transaction.
The issuer's public key modulus is also stored in the card: the
leftmost bits of the modulus are stored in the 6th record while
the rightmost bits are stored in another area of the memory.

Figure 2 is a (partial) anonymised dump of a transportation
card compliant with the Calypso standard [4]. The content of
the records is not defined by Calypso, it is indeed let to the
discretion of the public transportation operator.

This Calypso dump uses an home-made encoding, hereafter
called the 5-bit encoding, to store the holder name. To decode
the name, the binary representation of the sequence must be
split into 5-bit pieces. These pieces are then decoded with the
rule (decimal representation): A=1, B=2, C=3, etc. The holder
name is the second underlined sequence (omitting the first bit)
on the Holder1 line that continues on the Holder2 line and
represents "James Smith".

The first underlined sequence represents the holder birthdate,
encoded with BCD, it represents 1975/07/10. The birthdate and

the name of the holder are very close. Due to the length of the
encoding function and the starting index of the name, the holder
name binary data is not byte-aligned. Other data stored in the
device include the last trip in the three EvLog lines (date and
time, bus line and stop, etc.) and the contracts related to the card
in the ConList line. The dump has been almost fully decoded
without the knowledge of the application specifications, which
made the task time-consuming.

## 2.2 Related works

A large body of literature exists in the field of memory forensics,
but most of published techniques are not suited to our case, as
detailed below. The analyses typically focus on hard drives [15]
and volatile memories [2]. For file carving, the main difficulty is
the file fragmentation in the system. Techniques target specific
file formats, e.g., PDF, ZIP [5]. Analyses of volatile memories
consist in searching for special strings or signatures, interpret-
ing internal kernel structures, or enumerating and correlating
all page frames, in order to retrieve running and terminated pro-
cesses, open ports, sockets, hidden data, etc. Another technique
provided by [9] that retrieves textual information in bulk data
and classifying them into categories: URLs, email addresses,
words, etc. The authors also provide a tool that implement their
method: bulk extractor [6]. However, the tool does not test all
the possible encoding functions, does not try all the possible
offsets, and does not eliminate non-information. Nevertheless,
these techniques can not be applied to our context, as detailed
below.

There also exist two research fields related to textual infor-
mation retrieval information in data as text mining and text (or
document) retrieval. Text mining [19] is an interdisciplinary
field combining data mining and computational linguistics,
which extracts knowledge from text documents. For example,
the text analysis technique extracts knowledge by analysing
the relationship between words and phrases in documents. This
technique is not applicable to our case, though, because the
dumps we consider typically contain independent strings. The
second research field we mentioned above is the document re-
trieval [18], which aims to retrieve documents related to a given
information from a collection of text documents. For each doc-
ument, a score related to the sought information is calculated,
then the documents with the best scores are returned. It works
with a collection of text documents, whereas we deal with raw
data from smart cards memories and we do not know exactly
what information is sought.

Memory carving of smart cards differs from traditional com-
puter forensics. It is explained by several reasons: (i) dumps are
generally of few kilobytes only, (ii) memory of smart cards is
poorly structured, different kinds of information are stored side
by side using different encoding functions, (iii) there are no
file metadata indicating the file format like JPEG, (iv) obtained
dumps are not a bit-by-bit copy of the EEPROM memory, it
corresponds to the data accessible with the API of the device,
(v) it is possible to perform a multi-dump analysis with several
dumps of the same application, (vi) contextual information can
be exploited.
<figure><img src="image_2.png" /><figcaption>Figure 1: Extract of an anonymised EMV dump.</figcaption></figure>

<figure><img src="image_3.png" /><figcaption>Figure 2: Extract of an anonymised Calypso dump.</figcaption></figure>

Almost all existing contributions on the memory carving problem for smart cards consider ad-hoc, hand-made analyses [1, 13]. An exception is the work of Van Deursen et al. [20], who investigate the memory carving problem for dumps of public transportation cards. They propose to automatically locate where the information is stored on the dump but does not provide an automatic interpretation of the data and it requires contextual information (as information printed on the ticket). Another work is due to Gougeon et al. [10], who investigate an automatic distinction of cryptographic data in dumps of embedded devices. However, they did not provide any interpretation of non-cryptographic data.

## 2.3 General sketch

The method introduced in this paper aims to retrieve textual information stored in dumps obtained from non-volatile memory of smart cards. It consists of a three-step process that combines lexical, syntactic, and multi-dump analyses. Figure 3 illustrates the workflow of this process.

First, a lexical analysis constructs strings, by assembling symbols obtained after applying a decoding function on the dump. Assuming that the correct encoding functions are used, the lexical analysis generates a set of strings containing all the textual information stored in the device. Unfortunately, this step also generates many non-information.

The generated non-information are eliminated in the second step, with a syntactic analysis checking for each string of the set whether it is meaningful or not. The syntactic analysis looks at the *n*-grams of each string, and computes scores using a Bayesian classifier. The *n*-grams are all the *n*-character contiguous subsequences of the considered string.

The last step is a multi-dump analysis which requires several dumps of the same application to be performed. It combines the scores obtained by the syntactic analysis. If only one dump

is available, the multi-dump analysis cannot be applied, and the analysis ends after the syntactic analysis.

<figure><img src="image_4.png" /><figcaption>Figure 3: Method overview</figcaption></figure>

# 3 LEXICAL ANALYSIS: GENERATE STRINGS

The lexical analysis is a two-step procedure that decodes a memory dump into characters, and assemble them into strings.

## 3.1 Decoding data

Let $f$ be a decoding function applied on $m$ bits such that $f: \{0, 1\}^m \rightarrow \{0, 1, \dots, 2^m - 1\}$. For example, if the decoding function is ASCII, the input is a 8-bit sequence and the output represents the ASCII code of the character. All outputs of the function do not necessarily represent a character.
In our context of smart cards, encoding functions do not necessarily use entire bytes, and data are not necessarily byte-aligned (see for example the Calypso dump in Section 2.1). As a consequence, the decoding function has to be applied on all possible offsets. Let $D$ be a $n$-bit dump, that is a binary sequence $(b_i)_{1 \le i \le n}$, the decoding function is applied on $D$ to compute:

$$ \{f((b_i)_{\alpha \le i \le \beta}), 0 \le j \le \lfloor \frac{n}{m} \rfloor, 0 \le k \le m-1\} $$

where $\alpha = jm + k + 1$ and $\beta = (j+1)m + k$, and where $k$ is called the offset.

An example is given below, using the 5-bit decoding function with a 1-bit offset to decode the name stored in the Calypso dump provided in Section 2.1. The name is stored in hexadecimal: `0x282D2CF`, then the associated binary sequence is $D = 0010100000101101001011001111$. Other parameters are $m = 5$, $k = 1$ and $n = 28$. The decoding function is applied as follows, $f(01010)$, $f(00001)$, $f(01101)$, $f(00101)$, $f(10011)$, returning the integers 10, 13, 5, 19, which correspond to the alphabetical characters “james”.

Operators often discard diacritical marks (e.g., accents, cedilla, and tilde) on letters when they store information. As a consequence, only alphabetical characters, from “a” to “z”, upper or lower case, and characters used for e-mail addresses or URLs are considered (e.g. “.”, “@”, “_”, “/”, etc.). This implies that UTF-8 and other popular decoding functions provide the same result than ASCII. This strongly reduces the set of encoding functions to be considered.

## 3.2 Assembling the outputs

Strings are created by assembling consecutive alphabetical (plus “:”, “@”, etc.) outputs generated by the decoding function for each possible offset. Given a dump and a decoding function, a final set of strings is therefore built, where each string is either an information or a non-information.

The above method might generate noisy strings. Indeed, if a given information in a dump is stored close to arbitrary data that are decoded as valid outputs, then the built string consists of the information appended to the arbitrary data. By construction, the arbitrary data so-called *noise* can only be at the beginning or at the end of the information.

For example, the birthdate and the holder name are closely located in the Calypso dump provided in Figure 2. The 5-bit decoding function applied to the birthdate `0x19750710` generates alphabetical characters. The holder name is consequently noised by these arbitrary characters, and the outputted string is “lwjaxprjames” instead of “james”.

Due to the large number of possible decoding functions and offsets, the lexical analysis outputs strings that are information (possibly noised), but it also outputs a large number of strings that are non-information.

# 4 SYNTACTIC ANALYSIS: KEEP MEANINGFUL STRINGS ONLY

## 4.1 Information vs non-information

The input of the syntactic analysis is the set of strings generated by the lexical analysis. The syntactic analysis aims to identify

strings that have been decoded with the correct function. Otherwise, the information is either encrypted or obfuscated, which is out of the scope of this paper. The syntactic analysis purpose is to identify strings that contain (at least) one meaningful substring.

A string decoded with the correct function, such that it contains a meaningful substring, is called an information. Note that a string might contain a meaningful substring while the decoding function used during the analysis was incorrect. Whenever an incorrect decoding function is used, the generated string is called a *non-information*. A non-information classified by the syntactic analysis as an information is a false positive.

For example, the string “uuvehicle” contains a meaningful substring. If the string was decoded with the correct function, then “uuvehicle” is an information. If “uuvehicle” was “luckily” obtained, then it is a non-information, although it contains a meaningful substring. A string that does not contain any meaningful substring, e.g., “kktkuixxxan” is also a non-information.

Later, we are going to see that the syntactic analysis is quite efficient to identify strings that contain a meaningful substring. However, a non-information that contains a meaningful substring certainly leads to a false positive. The multi-dump analysis will fortunately discard most of these false positives.

## 4.2 General sketch

The syntactic analysis evaluates the proximity of each analysed string with existing words belonging to a given corpus. A preliminary step of the syntactic analysis consists in elaborating a large dictionary of all potential textual information. The first part checks whether the analysed strings belong to it. The dictionary can be completed with extra contextual information, as information printed on the device (e.g., name and date); information about the holder (e.g., address, name, and company); information about the transaction (e.g., date and location); etc.

However, it is impossible in practice to create an exhaustive dictionary of proper and common nouns. In particular, new nouns are regularly created, still following usual construction rules, though. Moreover, textual information are wrapped in noisy strings due to the method used for their generation. We propose therefore to complete this dictionary analysis with a Bayesian classifier to distinguish information from non-information.

## 4.3 Bayesian classifier for textual information

In the context of retrieving textual information in a dump, a naive Bayesian classifier assigns a class to a string. Possible classes are I (Information) and Ï (Non-information). Each string is characterized by a vector $\vec{x} = \langle x_1, x_2, x_3, ..., x_n \rangle$ that represents $n$ independent features. Here, the features $x_i$ represent the presence of each $n$-gram of the string to classify. For example, if “ab” is the string to classify, the vector of features that represents the string is $\vec{x} = (“ab”, “a”, “b”).$

A naive Bayesian classifier is a machine learning technique using the Bayes' theorem with strong independence assumption between the features. It considers that all the features of the instance contribute independently to the probability of its belonging to a class. Since it is done regardless of any possible
correlations between the features, this classifier is considered as naive. Naive Bayesian classifiers reach good results in spite of its naive assumption [21].

The naive Bayesian classifier assigns to each string and for each class $C_k$ the probability $Pr(C_k | \vec{x})$ that the string represented by $\vec{x}$ belongs to the class $C_k$. Using the Bayes' theorem we have: $Pr(C_k | \vec{x}) = Pr(\vec{x} | C_k) Pr(C_k) / Pr(\vec{x})$. Using the independence assumption between the features $x_i$ in classes $C_k$, the conditional probability $Pr(\vec{x} | C_k)$ can be rewritten as follows: $Pr(\vec{x} | C_k) = \prod_{i=1}^{n} Pr(x_i | C_k)$.

For each string represented by $\vec{x}$, the assigned class is the one that has the highest probability $Pr(\vec{x} | C_k)$ among all the $C_k$ classes. The value $Pr(\vec{x})$ does not depend on the class $C_k$. Therefore, to find the class $C_k$ that leads to the highest probability $Pr(\vec{x} | C_k)$ the denominator $Pr(\vec{x})$ can be ignored.

The conditional probability $Pr(x_i | I)$ represents the probability that an information contains the n-gram $x_i$. These probabilities are computed using a training corpus, which is the dictionary used in the first step of the syntactic analysis. All words of the corpus belong to the class I, other words belong to the class $\bar{I}$. The set of words in the class I and $\bar{I}$ need to be finite in order to compute the probabilities, therefore a maximum length $\ell_{max}$ for the words is fixed. Pr(I) represents the probability that a string belongs to the class I. This probability depends of the source of the data (EMV, Calypso, etc.) and the decoding function used to generate the strings. This value is defined experimentally, but if no experimental data are available the value $Pr(i) = 0.5$ can be used as a default value. Experiments have shown that using a different value than the optimal one for $Pr(i)$ decreases the recognition rate by less than 0.5%.

The details to compute the probabilities are provided below. The length of the feature $x_i$ is denoted $\ell_{x_i}$, $C$ represents the number of words in the corpus, $C_{x_i}$ represents the number of words containing $x_i$ in the corpus. The value $S = \sum_{i=1}^{\ell_{max}} 26^i$ represents the number of strings of length from 1 to $\ell_{max}$ characters. So we have $\bar{C} = S - C$, with $\bar{C}$ representing the number of strings that are not in the corpus. The value $S_{x_i} = \sum_{\ell=\ell_{x_i}}^{\ell_{max}} S_{x_i}^\ell$ is the number of strings containing the $\ell_{x_i}$-gram $x_i$. Finally, the value $S_{x_i}^\ell = (\ell - \ell_{x_i} + 1) * 26^{(\ell - \ell_{x_i})}$ represents the number of strings of $\ell$ letters containing a $\ell_{x_i}$-gram. We thus have: $Pr(x_i | I) = C_{x_i} / \bar{C}$, which represents the probability to have the $\ell_{x_i}$-gram $x_i$ given the string containing $x_i$ is an information. Also:

$$Pr(x_i | \bar{I}) = \frac{\bar{C}_{x_i}}{\bar{C}} = \frac{S_{x_i} - C_{x_i}}{S - C}$$

represents the probability to have the $\ell_{x_i}$-gram $x_i$ given the string containing it is a non-information.

Some abnormal events can happen and need to be handled. Here, an abnormal event is a $\ell_{x_i}$-gram $x_i$ that belongs to a string (represented by $\vec{x}$) but that does not appear in the training corpus. This case happens because a textual information can be wrapped in a noisy string, and the dictionary is not assumed to be exhaustive. The numerator of $Pr(\vec{x} | I)$ is a product, and so if one component is null, the final result of the product is null. As a consequence if one feature of the string is not in the corpus of the class I then $Pr(\vec{x} | I)$ is null. We do not want that a

$n$-gram that does not belong to the corpus makes $Pr(\vec{x} | I)$ null. Therefore, when a $n$-gram does not appear in the corpus, it is ignored in the probability calculation. It is an indecision case, and it is equivalent to assign the same probability to $Pr(x_i | I)$ and $Pr(x_i | \bar{I})$.

When a string contains non-alphabetical characters (e.g., "@"), the string is split in subsequences containing only alphabetical characters. If at least one subsequence is considered as an information by the classifier, then the string is classified as an information as well.

## 4.4 Efficiency analysis

### 4.4.1 Data.
A set $S$ containing 10,000 strings is built, with 5,000 strings that are information and 5,000 strings that are non-information. This set is built in order to evaluate the recognition rate of the information and also the amount of generated false positives. Experiments have been realised with 10 different sets $S$. The 5,000 strings that are information are randomly picked from the training corpus. Once done, these strings are removed from the corpus to avoid a trivial recognition due to the dictionary-based analysis.

The training corpus used for the class I is a list of 400,000 distinct words from two different sources. The first source is a French dictionary containing 150,000 words (from John The Ripper [16]). The second source contains several list of names and first names, representing 250,000 words (principally from the US Census [3]). Other corpus have been tested, without yielding better results. For example, the use of the English dictionary of John The Ripper in addition to these two first sources does not improve the final recognition rate of our experiments.

Non-information should represent the strings that are generated from applying a decoding function on data encoded with another decoding function. It is practically (almost) impossible to create a model that is representative of the non-information stored in the smart card. As a consequence, these strings are considered as being generated by a uniform random source. More precisely, each string is generated as follows: a length $\ell$ is picked uniformly between 4 and 15, then $\ell$ alphabetical characters are picked uniformly and are concatenated to build a string. If the string belongs to the corpus, then it is discarded.

### 4.4.2 Analysis based on a dictionary.
The first step of the syntactic analysis verifies whether the string contains a word of the dictionary. Using too short words generates a lot of false positives, and using too long words misses information. Experiments showed that the optimal length is 5 characters (longer or equal to).

The first row of Table 1 presents the results of a dictionary analysis only using the set $S$. It recognises more than 76% of information and does not generate false positives. Strings of the class $\bar{I}$ recognised as I are the false positives. In the table, $RR_c$ represents the recognition rate of the class $c$, $RR$ represents the mean of the recognition rate of class I and $\bar{I}$.

### 4.4.3 Analysis based on a dictionary and a classifier.
The second row of Table 1 presents the results of applying the syntactic analysis on the set $S$. The probability $Pr(I)$ used here is 0.5. It reaches a recognition rate greater than 98% on average for each class. The recognition rate is improved by more than
<table><caption>Table 1: Efficiency of dictionary analysis.</caption><thead><tr><th>Analysis</th><th>%RR<sub>I</sub></th><th>%RR<sub>I&#773;</sub></th><th>%RR</th></tr></thead><tbody><tr><td>Dictionary</td><td>76.30</td><td>100.0</td><td>88.15</td></tr><tr><td>Dictionary + classifier</td><td>98.8</td><td>98.5</td><td>98.7</td></tr></tbody></table>

20% compared to the analysis that only uses a dictionary. On the other hand, it generates false positives, but there is only 1.5% of the non-information strings that are classified as information by the syntactic analysis.

# 5 EXPERIMENTS

The syntactic analysis is performed on a set of strings generated by the lexical analysis realised on real-life dumps. Note that the multi-dump analysis is not applied at this stage.

## 5.1 Experimental Dataset

The data used in the following experiments come from memory dumps of real-life smart cards:

* 112 dumps from 40 different ski passes,

* 91 dumps from Calypso card issues by 5 companies (with 9 different holders),

* 55 dumps from tickets transport from various cities from Italy, Japan, Canada, Finland, China, France, Belgium, etc.,

* More than 50 dumps from various applications (Belgian ID, French health dossier, EMV, French loyalty card, Amiibo game figurines, coffee card, business cards, etc.),

* 30 dumps from different payment cards (EMV) of a dozen of holders from a decade of banks,

* 7 Belgium passports from 7 holders.

Our dataset contains more than 350 memory dumps, from more than 200 different devices from more than 50 different applications. We believe our dataset is representative of (at least) ISO 7816-compliant devices, though. Note that, we have never detected any ciphered data in our dumps. Also, no more than 10 devices among the 200 analysed ones were protected by an authentication mechanism, e.g., Mifare DESFire. In rare cases, the access of a part of the data is restricted like in biometric passports where the access to biometric data is protected.

The decoding functions that are applied to the above-mentioned dataset are the ASCII decoding on 8 bits (ASCII-8) and 7 bits (ASCII-7), the 5-bit decoding (5-bit), the UU encoding scheme using 6 bits, and base64.

Note that we are not aware of any other decoding function that is neither equivalent to the listed ones, nor artificially built. Considering all the decoding functions and possible offsets, the lexical analysis generates 190,093 strings as presented in Table 2 where the columns Information and Non-information represent the ground truth of the strings.

The ground truth, (i.e. the theoretical class of each generated string by the lexical analysis) needs to be known in order to evaluate the efficiency of the lexical and syntactic analyses. Given all the specifications of the applications we consider are not known, a preliminary hand-made investigation is performed to assign a class – information or non-information – to each generated string. Human can hardly classify (with a sufficient

<table><caption>Table 2: Strings generated by the lexical analysis</caption><thead><tr><th>Decoding</th><th>Strings</th><th>Information</th><th>Non-information</th></tr></thead><tbody><tr><td>ASCII-8</td><td>1,017</td><td>421</td><td>596</td></tr><tr><td>ASCII-7</td><td>3,462</td><td>0</td><td>3,462</td></tr><tr><td>5-bit</td><td>58,001</td><td>171</td><td>57,830</td></tr><tr><td>5-bit-8</td><td>53,772</td><td>533</td><td>53,239</td></tr><tr><td>UU</td><td>2,872</td><td>8</td><td>2,864</td></tr><tr><td>Base64</td><td>70,969</td><td>0</td><td>70,969</td></tr><tr><td>Total</td><td>190,093</td><td>1,133</td><td>188,960</td></tr></tbody></table>

confidence) strings that are shorter than 5 letters. As a consequence, only strings that are longer or equal to 5 characters are kept to evaluate the syntactic analysis. Though, this does not mean that the syntactic analysis is not able to assign a class to strings shorter than 5 characters. The ground truth was created exploiting (i) specifications, e.g., EMV cards [8] and electronic passports [12], (ii) previous ad hoc investigations, e.g., transport cards [1] and ski passes[17], and (iii) tools interpreting the data of smartcards, e.g., Cardpeak [14] and Belgium eID application [11].

## 5.2 Evaluation metrics

Given a set of *n* strings $S = \{s_i, 1 \le i \le n\}$ and a set of classes $C := \{I, \bar{I}\}$, a class label $\ell_i$ is assigned to each string. Let $L$ be a set of *n* labels such that $L = \{\ell_i = \text{Class}(s_i) \in C, 1 \le i \le n\}$ representing the ground truth. $S$ contains $n_I$ information and $n_{\bar{I}}$ non-information with $n_I + n_{\bar{I}} = n$.

Let $P$ be a set of prediction $P = \{p_i, 1 \le i \le n\}$ representing the prediction of the syntactic analysis where each $p_i$ is computed as follows,

$$p_i = \begin{cases} I, & \text{if } \Pr(\bar{x}_i | I) > \Pr(\bar{x}_i | \bar{I}) \\ \bar{I}, & \text{otherwise} \end{cases}$$

where $\bar{x}_i$ represents the features of the string $s_i$. Let $V$ be a vector that represents the success of the prediction: $V = \{v_i, 1 \le i \le n\}$ where each $v_i$ is computed as follows:

$$v_i = \begin{cases} 1, & \text{if } p_i = \ell_i \\ 0, & \text{otherwise.} \end{cases}$$

Let $V^c$ be a vector representing the success of the prediction for a given class $c$, $V^c = \{v_i^c, 1 \le i \le n\}$ where each $v_i^c$ is computed as follows:

$$v_i^c = \begin{cases} 1, & \text{if } p_i = \ell_i = c \\ 0, & \text{otherwise.} \end{cases}$$

Let $E^c$ be a class error vector $E^c = \{e_i^c, 1 \le i \le n\}$ representing the error for a given class $c$ where each $e_i^c$ is computed as follows:

$$e_i^c = \begin{cases} 1, & \text{if } p_i \neq \ell_i \text{ and } \ell_i = c \\ 0, & \text{otherwise.} \end{cases}$$

We thus have: $\forall i, 1 \le i \le n, \sum_{c \in \{I, \bar{I}\}} (v_i^c + e_i^c) = 1$. The recognition rate of the syntactic analysis for all the classes is computed as follows: $RR = \sum_{i=1}^{n} v_i/n$. The recognition rate of the syntactic analysis for a given class $c$ is computed as follows:
$RR_c = \sum_{i=1}^{n} v_i^c / n_c$. The balanced recognition rate representing the mean of the recognition rate of each class is computed as follows: $BRR = \sum_{c \in C} RR_c / |C|$. Note that the BRR is preferred to the RR when the number of information strings is significantly different from the number of non-information strings in the set generated by the lexical analysis. Finally, the precision represents the ratio of (ground truth) information strings among the strings classified as information by the syntactic analysis. It is computed as follows: $PR = \sum_{i=1}^{n} v_i^I / \sum_{i=1}^{n} (v_i^I + e_i^I)$.

## 5.3 Experimental results

The syntactic analysis is applied to the strings outputted by the lexical analysis on real-life smart cards. The probability Pr(I) used here is 0.5%, which is the ratio of information strings among the outputted strings. The results are presented in Table 3.

<table><caption>Table 3: Rates of the syntactic analysis.</caption><thead><tr><th>Decoding</th><th>%RR<sub>I</sub></th><th>%RR<sub>I</sub></th><th>%BRR</th><th>%PR</th></tr></thead><tbody><tr><td>ASCII-8</td><td>99.76</td><td>93.12</td><td>96.44</td><td>91.11</td></tr><tr><td>ASCII-7</td><td>NA</td><td>97.40</td><td>NA</td><td>NA</td></tr><tr><td>5-bit</td><td>100.0</td><td>96.73</td><td>98.37</td><td>8.30</td></tr><tr><td>5-bit-8</td><td>98.69</td><td>96.9</td><td>97.79</td><td>24.13</td></tr><tr><td>UU</td><td>100.0</td><td>98.29</td><td>99.14</td><td>14.03</td></tr><tr><td>Base64</td><td>NA</td><td>94.94</td><td>NA</td><td>NA</td></tr><tr><td>Mean</td><td>99.29</td><td>96.13</td><td>97.71</td><td>13.33</td></tr></tbody></table>

Using the 5-bit decoding function, the syntactic analysis recognises 26 unique information representing names and first names from the Calypso cards and the French health insurance card. Using the 5-bit decoding function, false positives generated represent 1,888 strings among the 58,001 strings obtained by the lexical analysis. On average, applying the lexical analysis with the 5-bit encoding on only one Calypso dump generates 83 strings. On average, the syntactic analysis considers 4 strings as information, 2 of them represent the first name and the family name of the holder, the 2 others are false positives.

Using the ASCII-8 decoding function, 134 different strings are recognised as information among the 135 to retrieve. The only information that is not recognised is a name with rare n-grams like “uza”. There are only 41 false positives generated among the 1,017 strings generated by the lexical analysis. Retrieved information essentially consists of family names, first names, cities, email addresses, and application names. On average, applying the lexical analysis with the ASCII-8 decoding on only one EMV dump generates a decade of strings. Only 4 of them are different. In most cases, the syntactic analysis does not generate any false positive. The information retrieved are the holder name and first name, and some information about the application as “transaction”, “mastercard”, “debit”.

Using the UU decoding function, the syntactic analysis recognises 8 unique information representing addresses from the French health insurance card. False positives generated

represent 49 strings among the 2,872 strings obtained by the lexical analysis.

The 5-bit-8 decoding function generates at least the same candidates as the ASCII-8 decoding function. After applying the syntactic analysis, it generates 1,654 false positives among the 53,772 strings generated by the lexical analysis.

There is no information stored with the ASCII-7 encoding function in our dumps. After applying the syntactic analysis, it generates 90 false positives among the 3,462 strings generated by the lexical analysis.

There is no information stored with the base64 encoding function in our dumps. After applying the syntactic analysis, it generates 2,188 false positives among the 70,969 strings generated by the lexical analysis.

Starting with 190,093 strings, the syntactic analysis eliminates 181,654 strings. It remains 8,439 (4,4%) strings that are considered as information, 1,125 of them are indeed information while the 7,314 other ones are false positives. Some decoding functions do not generate any information on our dataset. Nevertheless, it is interesting to evaluate the amount of false positives they generate. Most of false positives are generated by the decoding function where a large proportion of the possible outputs are alphabetical characters as the 5-bit, the 5-bit-8, and the base64. Most of them are shorter than 7 characters as “cogra”, “darat”, “error”, etc. These short words are made of commonly used n-grams or represent words, as “error” in English. Longer false positives are mainly composed of a subsequence of our training corpus luckily obtained as “tqqihandsqdlkjn” containing “hands”. Most of them will be discarded with the multi-dump analysis. Table 4 details the information retrieved in our 350 real-life dumps.

# 6 MULTI-DUMP ANALYSIS

Dumps obtained from the same device or devices belonging to the same application (e.g., EMV) own similarities in their memory structure. This specificity is used to combine scores obtained by the syntactic analysis and improves the recognition rate.

## 6.1 Similarities in a set of dumps

A set of dumps of the same application can be obtained by dumping the memory of different devices belonging to several holders. It can also be acquired by dumping the same device at different moment of the card lifetime, e.g., before and after a cash withdrawal for bank cards.

One may expect that dumps belonging to a given application to be identically structured, i.e., containing the same fields, in the same locations. For example, in some Calypso dumps, the name, the birthdate, and the postal code of the holder or details of his last trips are always located at the same place in the dump, with the same encoding. The data of these fields vary for each dump but represent the same kind of information. A direct consequence of these similarities is that knowing the location and the encoding of an information in one dump of the application permits to retrieve this information in all the dumps of the application.
<table><caption>Table 4: Retrieved information using our method on 350 real-life dumps.</caption><thead><tr><td>Application</td><td>Retrieved information fields</td></tr></thead><tbody><tr><td>Hospital access card</td><td>&lt;family name&gt;, &lt;first name&gt;</td></tr><tr><td>UCL Member</td><td>&lt;family name&gt;, &lt;first name&gt;, &lt;URL&gt;, &lt;email address&gt;</td></tr><tr><td>Calypso</td><td>&lt;family name&gt;, &lt;first name&gt;</td></tr><tr><td>Passport and eID</td><td>&lt;family name&gt;, &lt;first name&gt;, &lt;place of birth&gt;, &lt;place of creation&gt;</td></tr><tr><td>Business cards</td><td>&lt;family name&gt;, &lt;first name&gt;, &lt;email address&gt;, &lt;company address&gt;</td></tr><tr><td>EMV cards</td><td>&lt;family name&gt;, &lt;first name&gt;</td></tr><tr><td>French Health cards</td><td>&lt;family name&gt;, &lt;first name&gt;, &lt;Children name and first name&gt;, &lt;holder address&gt;</td></tr></tbody></table>

There exists cards, e.g., Mifare Classic and Ultralight that are memory storage devices. They always own the same structure in their memory which is separated into several sectors of fixed length. For devices with elementary files containing records, the memory structure is not always identical in practice. Some records are possibly missing, or have not the same length in some devices. For example, for EMV cards, depending on the bank, the memory structure can differ. They do not store necessarily the same number of transactions and do not necessarily contain all existing records of the EMV specifications. Consequently, for these dumps, a pre-processing phase is needed to identify the records in each dump of the application. All records are separated due to the data recovery technique, therefore the pre-process aims to match the records between the dumps. It does not require the knowledge of the card specifications, because it is performed by analysing the data structure of the dump and the data into the record

An example of a dump set of train tickets (Mifare Ultralight cards) from the national rail transport in the Netherlands is given in Figure 4. For example, the two first bytes of the 4-th line represent the date of validity of the ticket. The date is the same in the dumps 1 and 3 and differ in the dumps 2 and 4.

<table><caption>Figure 4: Four dumps extracts of train tickets.</caption><thead><tr><td></td><td>Dump 1</td><td>Dump 2</td><td>Dump 3</td><td>Dump 4</td></tr></thead><tbody><tr><td>1.</td><td>04B3FBC4</td><td>0400FD71</td><td>04CCFBBB</td><td>04C3307F</td></tr><tr><td>2.</td><td>22F83380</td><td>22F83381</td><td>22F83380</td><td>02D13E80</td></tr><tr><td>3.</td><td>694800F0</td><td>684800F0</td><td>694800F0</td><td>6D4800F0</td></tr><tr><td>4.</td><td>C9CDFFFE</td><td>C9CBFFFF</td><td>C9CDFFFE</td><td>C9C9FFFF</td></tr><tr><td>5.</td><td>C0003004</td><td>C8001004</td><td>C0003004</td><td>C8001004</td></tr><tr><td>6.</td><td>CD8CD521</td><td>0D8D3220</td><td>CD8CD521</td><td>0D8DB8A0</td></tr><tr><td>7.</td><td>069F507F</td><td>AE8F6350</td><td>FB3F7464</td><td>75F34FEA</td></tr><tr><td>8.</td><td>A98A5318</td><td>B1948307</td><td>70E99A45</td><td>C2469EB1</td></tr></tbody></table>

## 6.2 Methodology

Let $D = \{D_k, 1 \le k \le N\}$ be a set of dumps. Given the textual information format, an arbitrary decoding function with an arbitrary offset, applying the lexical analysis on each dump $D_k$ generates a set of $n$ strings $W_k = \{w_i^k, 1 \le i \le n\}$. Let Class($w_i^k$) be the class (I or $\bar{I}$) of $w_i^k$.

As previously explained, the data located at the same place on each dump $D_k$ are likely to be encoded with the same function and represent the same kind of information. Therefore,

the strings generated at this location by the lexical analysis are related and they all belong to the same class, I or $\bar{I}$.

Classes obtained by the syntactic analysis on these related strings can be combined in order to decide jointly rather than separately, whether they are information or not. Assuming that the $i$th string of each set $W_k$ obtained from a dump $D_k$ is related to the $i$th string of other sets, there are $n$ sets of strings $\hat{W}_i = \{w_i^k, 1 \le k \le N\}$. The classification of each string of $\hat{W}_i$ is done by a majority vote: Class($\hat{W}_i$) = MajorityVote($\{Class(w_i^k)\}_{1 \le k \le N}$).

In practice, all the values for a kind of information do not have the same length. For example, names in the Calypso dump of Section 2.1 always start from the same index, but do not end at the same one. In other dumps, the information does not start always at the same position. Therefore, related strings are the ones that use least one shared index bit with other dumps of the set.

## 6.3 Experimental results

The 350 dumps are grouped into sets according to the application they belong to (e.g., EMV, Passport, etc.). So, more than 50 sets are so created. Each set that contains less than 3 dumps is discarded because the multi-dump analysis cannot be applied in such a case due to the majority vote function. It remains 25 sets, which all together contain 292 dumps. We apply the syntactic analysis to the 292 selected dumps. Then, we apply the multi-dump analysis on the same dumps grouped into sets. The syntactic analysis outputs 2,363 false positives on the 292 selected dumps.

<table><caption>Table 5: Rates of the multi-dump analysis.</caption><thead><tr><td>Decoding</td><td>%RR<sub>I</sub></td><td>%RR<sub>I</sub></td><td>%BRR</td><td>%PR</td></tr></thead><tbody><tr><td>ASCII-8</td><td>100.0</td><td>99.47</td><td>99.73</td><td>98.30</td></tr><tr><td>ASCII-7</td><td>NA</td><td>98.76</td><td>NA</td><td>NA</td></tr><tr><td>5-bit</td><td>100.0</td><td>98.70</td><td>99.35</td><td>44.0</td></tr><tr><td>5-bit-8</td><td>100.0</td><td>98.04</td><td>99.02</td><td>33.40</td></tr><tr><td>UU</td><td>NA</td><td>97.88</td><td>NA</td><td>NA</td></tr><tr><td>Base64</td><td>NA</td><td>97.42</td><td>NA</td><td>NA</td></tr><tr><td>Mean</td><td>100.0</td><td>98.05</td><td>99.02</td><td>26.22</td></tr></tbody></table>

Table 5 shows the results of the multi-dump analysis. Applying the multi-dump analysis reduces the number of false positives from 2,363 to 1,013, that is less than 5 false positives per dump on average. So, 57% of the false positives generated
by the syntactic analysis are eliminated by the multi-dump
analysis. The precision grows up to 26.17%. Most part of false
positives remaining come from data that are identical in all
dumps of the application.

7 CONCLUSION

In this paper, we propose a three-step method to retrieve textual
information in memory dumps of smart cards. The first step is
a lexical analysis that generates strings from the raw data. The
second one is a syntactic analysis that uses a dictionary and a
Bayesian classifier to computes scores to decide whether the
strings are textual information. Finally, the multi-dump analysis
combines the syntactic analysis of several dumps coming from
the same application.

The three-step method reaches quite a high success rate. The experiments performed on more than 350 dumps show that the method can automatically retrieve more than 99% of textual information available in a single dump, while keeping the false positive rate as low as 5.5%. When at least three dumps coming from the same application are available, then the multi-dump analysis is performed. It still reduces the false positives rate downto 2%. To illustrate the efficiency of the method in our 292-dump experiments, we can point out that the multi-dump analysis generates 5 false positives only per dump and retrieves all the information. A tool implementing the method will be open-source in its final version.

A significant part of false positives comes from dumps con-
taining cryptographic objects (e.g., payment cards), thus, com-
bining this work with the one of Gougeon et al [10] may im-
prove the precision of the method. Future work will investigate
the retrieving of other information types, typically dates, in
memory dumps of embedded devices. Applying the method on
other kind of data as memory dumps, binary files, logs, etc. is
also considered.

REFERENCES

[1] Gildas Avoine, Luca Calderoni, Jonathan Delvaux, Dario Maio, and Paolo Palmieri. 2014. Passengers information in public transport and privacy: Can anonymous tickets prevent tracking? *International Journal of Information Management* 34, 5 (2014), 682–688.

[2] Mariusz Burdach. 2006. Physical memory forensics. (2006). https://www.blackhat.com/presentations/bh-usa-06/BH-US-06-Burdach.pdf.

[3] US Census. 2000. Frequently Occurring Surnames from the Census 2000. (2000). http://www.census.gov/topics/population/genealogy/data/2000_surnames.html.

[4] Calypso CNA. Calypso. (????). http://www.calypsostandard.net/, Accessed June 1, 2017.

[5] Michael I Cohen. 2007. Advanced carving techniques. Digital Investigation 4, 3 (2007), 119–128.

[6] Digital Corpora. 2015. BULKEXTRACTOR. (2015). http://www.forensicswiki.org/wiki/Bulk_extraction.

[7] Céline Delforge. 2009. La carte MOBIB mise à nu : le Ministre Smet doit s'expliquer. (2009). http://ecolo.be/?article1065.

[8] EMVCo. 2015. EMV Specification. (2015). https://www.emvco.com/specifications.aspx.

[9] Simson L Garfinkel. 2013. Digital media triage with bulk data analysis and bulk_extraction. *Computers & Security* 32 (2013), 56–72.

[10] Thomas Gougeon, Morgan Barbier, Patrick Lacharme, Gildas Avoine, and Christophe Rosenberger. 2016. Memory carving in embedded devices: separate the wheat from the chaff. In *ACNS*, Vol. 9696. Springer, Guildford, UK, 592–608.

[11] Belgium government. eidReader. (????). http://eid.belgium.be/en/using_your_eid, Accessed June 1, 2017.

[12] ICAO. 2016. Doc 93003, Machine Readable Travel Documents. (2016). http://www.icao.int/publications/Documents/9303_p3_cons_en.pdf.

[13] Jean-Louis Lanet, Guillaume Bouffard, Rokia Lamrani, Ranim Chakra, Afef Mestiri, Mohammed Monsif, and Abdellatif Fandi. 2014. Memory Forensics of a Java Card Dump. In *Smart Card Research and Advanced Applications*. Springer, Paris, France, 3–17.

[14] Alain Pannetrat. 2015. CardPeek. (2015). http://pannetrat.com/Cardpeak/.

[15] Rainer Poisel and Simon Tjoa. 2013. A Comprehensive Literature Review of File Carving. In *ARES, IEEE, Regensburg, Germany*, 475–484.

[16] Openwall Project. 2016. John the Ripper. (2016). http://www.openwall.com/john/.

[17] Wolfgang Rankl and Wolfgang Effing. 2004. *Smart card handbook*. John Wiley & Sons.

[18] Gerard Salton and Christopher Buckley. 1988. Term-weighting approaches in automatic text retrieval. *Information processing & management* 24, 5 (1988), 513–523.

[19] Ah-Hwee Tan. 1999. Text mining: The state of the art and the challenges. In *Proceedings of the PAKDD 1999 Workshop on Knowledge Discovery from Advanced Databases*, Vol. 8. Springer, Beijing, China, 65–70.

[20] Ton Van Deursen, Sjouke Mauw, and Sasa Radomirovic. 2011. mCarve: Carving Attributed Dump Sets.. In *USENIX Security Symposium*. USENIX Association Berkeley, San Francisco, California, USA, 107–121.

[21] Harry Zhang. 2004. The optimality of naive Bayes. In *Proceedings of the Seventeenth International Florida Artificial Intelligence Research Society Conference*. AAAI Press, Miami Beach, Florida, USA, 562–568.