A forensic analysis of the Google Home: repairing compressed data without error correction

TL;DR

This paper details a forensic process to extract and repair data from Google Home devices, introducing new methods for filesystem repair under error conditions, including handling multiple repairs with three-valued logic.

Contribution

It presents a novel approach to repair compressed filesystem data without relying on proprietary error correction methods, using logical inference for multiple repair scenarios.

Findings

Successfully extracted internal data from Google Home hardware.

Developed a new method to repair SquashFS files with single or double bitflips.

Proposed a three-valued logic approach to handle multiple potential repairs.

Abstract

This paper provides a detailed explanation of the steps taken to extract and repair a Google Home's internal data. Starting with reverse engineering the hardware of a commercial off-the-shelf Google Home, internal data is then extracted by desoldering and dumping the flash memory. As error correction is performed by the CPU using an undisclosed method, a new alternative method is shown to repair a corrupted SquashFS filesystem, under the assumption of a single or double bitflip per gzip-compressed fragment. Finally, a new method to handle multiple possible repairs using three-valued logic is presented.