Keysight's forensic team argues hardware-layer testing is now a prerequisite for locked-device investigations

A Keysight Device Security Testing team - Marc Witteman, Thomas Ostrowski, and Craig Mackson - published a detailed framework in August 2026 arguing that hardware security testing has become a necessary discipline for forensic investigators who encounter devices they cannot unlock through conventional software methods^[1].

The problem: physical possession is no longer enough

Modern devices increasingly use hardware-backed protections that software-level acquisition tools cannot reach^[1]. Secure boot, secure elements, Trusted Execution Environments (TEEs), and encrypted storage can each restrict how a device starts, how access is authorised, and how protected data can be retrieved^[1].

The practical consequence is stark. A forensic team may have physical possession of a smartphone, cryptocurrency wallet, flash drive, or other electronic device but still be unable to reach the information stored on it - able to examine parts of the software environment while access to the relevant data remains restricted by protections implemented elsewhere in the device.

The authors argue that the question shifts as a result. Instead of only asking how to extract the information, the team also needs to understand what is preventing access to it - which part of the device controls access, how that protection is implemented, and whether there is a technically viable way to bypass it.

Characterising the device before choosing a method

Because seized or unfamiliar devices rarely come with engineering documentation, the framework recommends a characterisation phase before any hardware-level intervention^[1]. This can include:

• Identifying key hardware components and available interfaces
• Observing device behaviour during security-sensitive operations
• Determining which components are involved in controlling access

The purpose is narrow: locate the specific security mechanism standing between the investigator and the evidence, then decide whether hardware-level testing is justified and which technique fits^[1].

Two techniques: SCA and fault injection

The framework centres on two methods. Side-Channel Analysis (SCA) measures physical signals produced while a device performs an operation, providing information about internal activity that is not visible through normal software access. Power consumption, electromagnetic emissions, and timing variations can all carry exploitable information about what a chip is doing internally.

Fault Injection (FI) applies a controlled disturbance while a device is operating to determine whether a specific security-sensitive operation can be influenced - and for a forensic investigation, FI can be used to bypass a security feature and unlock a device without ever needing the password.

Fault injection can be delivered through voltage glitches, clock manipulation, electromagnetic pulses, or optical (laser) techniques, each targeting different points in a chip's execution flow. Fault injection testing evaluates how devices behave under abnormal conditions by intentionally disrupting their operation; by introducing controlled faults, security teams can uncover weaknesses that allow attackers to bypass protections or alter system behaviour.

The authors are explicit that hardware testing must remain subordinate to the forensic objective. Hardware security testing should support the forensic objective, not become the objective itself - the goal remains access to information that is relevant to the investigation.

Build or outsource

An organisation that regularly receives protected smartphones, cryptocurrency wallets, embedded systems, custom electronics, or other strongly protected devices may have a stronger case for developing internal hardware security expertise. For others, engaging specialist labs on a case-by-case basis is the more proportionate response. The objective is not to build the largest possible hardware laboratory - it is to ensure that the organisation has an appropriate response when device security prevents investigators from reaching information required for a case.

The framework lands at a moment when hardware-backed security is expanding well beyond smartphones into cryptocurrency hardware wallets, industrial controllers, and custom embedded devices. As those device categories appear more frequently in investigations, the gap between what software forensic tools can reach and what investigators actually need is likely to widen - making the case for in-house hardware security capability harder to defer.