Technical field guide
The sections below preserve the service-specific depth behind Integrated Circuit Forensics, edited for the current national practice and its documented engagement model. Methods are selected for the source, authorization, system state and assigned specialty. No single tool or artifact establishes a conclusion, and legal, regulatory or certification decisions remain with the responsible authority.
Match the IC examination to the disputed question
Integrated-circuit forensics can address component failure, counterfeit substitution, damage, manufacturing variation, hardware integrity and the contents of non-volatile memory. Those questions require different evidence and laboratory methods. The examination plan identifies the package, markings, lot and board context, electrical condition, comparison samples and whether the assignment concerns function, construction, provenance or stored data.
Begin with non-destructive characterization
Visual documentation, dimensional measurement, marking comparison, electrical screening and appropriate imaging can identify package anomalies, bond-wire condition, die placement, voids, corrosion or unexpected construction without opening the component. X-ray, acoustic microscopy and other specialist methods may be coordinated when they are relevant and available through the assigned laboratory.
Comparison quality matters. A difference from a reference device can reflect a legitimate revision, factory, date code or packaging change. Findings therefore record the reference population and the basis for treating a variation as expected, unexplained or material.
Destructive analysis under written authority
Decapsulation, cross-sectioning, layer removal, focused-ion-beam work and die-level microscopy permanently change the source. They require written approval, a documented sequence and imaging before and after each material step. The sequence should preserve the options most likely to answer the question before a later method removes them.
Specialist techniques can include optical microscopy, SEM or EDS, electrical fault isolation and die or package comparison. The report distinguishes laboratory observations from opinions about cause, origin or intent.
Counterfeit and hardware-integrity questions
Counterfeit assessment can compare external markings, package construction, die identity, electrical behavior and traceability records. Hardware-integrity work can compare layout or function against known-good design material and test for unexplained circuitry or behavior. Neither a cosmetic difference nor a single failed test establishes counterfeiting or a hardware implant.
When embedded memory is involved, raw acquisition and decoding are treated as a separate workstream. A readable chip does not guarantee that controller translation, error correction, encryption or application structures can be reconstructed.
Laboratory record and expert reporting
Deliverables can include intake and custody records, high-resolution imagery, test conditions, instrument outputs, comparison tables, extracted data and a technical report. The report identifies subcontracted or specialist laboratory work, destructive changes, uncertainty and the evidence supporting each opinion.