French gendarmerie researchers show voltage glitching bypasses eMMC password locks on 3 of 10 commercial parts, with measurable evidence alteration

A team from France's Institut de Recherche Criminelle de la Gendarmerie Nationale published results on 18 August 2026 showing that voltage fault injection can bypass the CMD42 password lock on embedded flash storage - but at a measurable cost to evidence integrity. The paper, presented at the ARES 2026 International Workshops, is among the first to quantify both the access-restoration success rate and the data-corruption risk of hardware-level forensic acquisition on commercial eMMC parts.

The access problem hardware forensics is trying to solve

Digital forensic teams increasingly encounter devices where conventional acquisition paths - operating system interfaces, file-system tools, backups - are blocked by protections implemented in hardware rather than software^[1]. Secure boot, secure element, Trusted Execution Environment (TEE), and encrypted storage can restrict how a device starts, how access is authorized, and how protected information can be reached^[1]. A team may have physical possession of a smartphone, cryptocurrency wallet, or flash drive and still be unable to reach the data stored on it^[1].

Data extraction from mobile devices has grown significantly harder as mobile SoCs have become more complex and security-focused - progress from a privacy perspective, but a major challenge for lawful evidence recovery.

What the ARES 2026 paper tested

The researchers built a low-cost, firmware-independent bench using an ESP32 microcontroller to exercise the CMD42 lock and unlock command on ten commercial eMMC references under two physical approaches:

• Electromagnetic timing analysis - measuring signal leakage during password verification
• Voltage fault injection (crowbar glitching) - applying a controlled supply disturbance to disrupt the password-check operation

EM-based timing analysis found no exploitable leakage during password checks. Crowbar voltage glitching bypassed CMD42 on 3 of the 10 commercial eMMC parts tested. Once glitch parameters were tuned on one sample, the unlock was repeatable across identical instances of the same part.

The evidence-integrity question

Bypassing the lock is only half the problem. When conventional acquisition paths fail and hardware-level access restoration is used as a last resort, a question central to evidence handling arises: does the unlocking procedure alter the evidence, and if so, where?

The ARES paper measured this directly. Integrity checks on one completed fault-assisted extraction showed 0.1% image divergence after the procedure. While generally minor, these changes raise questions about the integrity and acceptability of evidence gathered in legal proceedings.

That figure matters because courts impose strict admissibility conditions on digital evidence. Digital evidence admissibility requires that a file remain unaltered during forensic processing and that results be valid, reliable, and reproducible. A 0.1% divergence is small in absolute terms, but its forensic significance depends on which sectors changed and whether those sectors contain data relevant to the case.

What this adds to the hardware forensics picture

The Keysight team's concurrent analysis in Semiconductor Engineering frames the broader methodology: hardware security testing - including side-channel analysis and fault injection - should support the forensic objective rather than become the objective itself^[1]. Fault injection applies a controlled disturbance while a device is operating to determine whether a specific security-sensitive operation can be influenced, and can be used to bypass a security feature and unlock a device without the password^[1].

The ARES 2026 paper puts empirical numbers on that framework for one specific target class. The key variables to watch as this work develops are:

• Which eMMC controller families are susceptible and at what glitch parameters
• Whether integrity divergence scales with the number of fault attempts required
• How courts in different jurisdictions treat fault-assisted extractions when divergence is documented and disclosed

The gendarmerie team's approach - measuring and reporting the alteration rather than ignoring it - points toward a controlled-method standard that could make hardware-layer forensic evidence more defensible in court.