Welcome back to our new series, “What is it Wednesdays.” We originally started this series internally during a “Will it Scan” event, where we put random objects into our Northstar X5000 225kV Computed Tomography (CT) scanner and challenged our staff to guess what the object was based on the recovered images.
The format of this series consists of us posting evidence packages every Wednesday, giving more and more information recovered from the devices. These evidence packages will contain artifacts from CT images, photographic images, bills of materials, recovered firmwares, recovered memory, and more. As we get into more complex devices there may or may not be a prize for the first individuals to correctly identify the device!
Last week we posted Evidence Package 1. There were a number of decent guesses as to what the board was, but nothing there just yet. We purposely did not include a size scale next to the images; however if you think about it, you can identify the footprint of a couple of the components and back out a scale from there.
This week we will take a closer look at the components themselves. This device is fairly straightforward, and once you see the BOM you will most likely know what it is. With that said, we will still go through the full process in which we would normally follow.
Evidence Package 2 (Bill of Materials)
Artifacts
The identification of the board components is often fairly straightforward when working through normal consumer devices like Device 001. The largest issue we tend to run into is that the parts are either long obsolete and/or the datasheets are protected under supplier NDAs. In this case, we have both of those conditions.
For the Hardware Bill Of Materials (HBOM) for this device, we used the standard manual process of taking high-quality photos of the board components and web searching for the part numbers. We were able to quickly recover the nature of the components manually and they are posted below.
When we start getting into larger boards with longer HBOMs, we will start exploring more automated means of conducting this analysis.
Active Components
| Manufacturer | NXP Semiconductors |
| Description | ACTIC-Pro |
| Part Number | F2951E0710 |
| Footprint | TSSOP38 |
Xtal 1
This one was a little more difficult. We knew what it was at a logical level after identifying IC2 and reversing the pinouts of that IC (so yes, we cheated in the context of this challenge). However, given historic knowledge, this package looks a lot like what we normally know as an oscillator. We didn’t immediately recognize this manufacturer symbol, nor was it in our database of electrical component symbols.
Matt took on the task of understanding the logical function, identifying the footprint, and filtering through the active components on Digikey to see if he could find a match. Which we believe we got. The interesting thing of this specific component is that this was not a bad photo but rather the text that is on this component is fuzzy. Which brought us to a notification from this exact manufacturer (https://www.ndk.com/en/news/article/notice_on_imitation_products_of_nihon_dempa_kogyo_co_ltd.html). While we do not believe this is a counterfeit, this is an interesting point that will lead into other devices.
| Manufacturer | Nihon Dempa Kogyo (NDK) |
| Description | Oscillator |
| Part Number | 8AD |
| Footprint |
Passive Components
| Manufacturer | ? |
| Description | From the CT scans, a LF coil |
| Part Number | ? |
| Footprint | ? |
Resistors, Capacitors
-Many. Unmarked and we left these untested for now.
Switches (momentary)
-SW1, SW2, SW3, SW4
