How we do a ‘Chip-Off’ Forensic Data Recovery on a Mobile Phone

Forensic data recovery and mobile phone investigation is the process of salvaging data from failed storage devices such as mobile phones or hard drives. We offer our services across a wide range of devices. Here we will look at our mobile phone side of the company, more specifically what is known as a chip-off operation. Chip off is a useful technique especially in forensic data recovery, also known as digital discovery, or eDiscovery: these are methods of data investigation used by police forces and insurance underwriters. Data Clinic Ltd are experts in recovering data from damaged phones and hard drives.

With any mobile phone or tablet, we initially attempt to inspect the phone, we determine if the failure is with the peripheral components such as batteries, charging ports and screens. If this is the case, then we wouldn’t need to go any further. For a lot of ediscovery data investigations cases however, this option serves as a process of elimination and if this first attempt of recovering the data is unsuccessful then we look at the more advanced options available to us. This is typically in the form of advanced micro soldering, JTAG or a Chip-Off operation.

So, what is a ‘Chip-Off’?

A Chip-off is the process of de-soldering the Flash Memory chip from the failed phone / tablet in the hope that we will successfully read its raw data independent of the device.

How do we do a Chip-Off recovery?

In order to complete a forensic data recovery on a mobile phone it’s first necessary to determine that a Chip-Off on a phone / tablet is needed then the next step is preparation. The phone must be fully dismantled, including the removal of any protective metal heat shields. When this is done we identify the eMMC (or NAND) memory chip place the PCB into a special holder underneath our stereo microscope as shown here.

What is now needed to remove any underfill from around the memory chip and add specialist flux to the chip. The Flux we typically use is Amtech Tacky Flux – the idea with this is to dispense it all around the chip then apply heat to it.

The main heat application we use is a Quick 861DA heat gun (image below). This is a station that offers a wide range of options when it comes to applying heat. We make sure to select a correct temperature, airflow and nozzle to do the job properly.

Once the chip has been lifted from the board after carefully applying the correct amount of heat we get the de-soldered chip, we then proceed to cleaning and re-balling the chip. This is a meticulous process whereby we need to ensure that each of the 100+ solder contacts have clean solder. It is a manual process that you need skill in precision soldering and a keen eye under the microscope to do.

Once each pin has been successfully and soldered in a uniform manner, it is time to clean it up with specialist chemical solutions. This ensures that the contacts are as clean as they can be and thus the read of the chip should also be good!

There are a lot of readers and programmers available worldwide that you can use to read the raw data of an eMMC NAND memory chip. The honest answer is they all have different capabilities for different chips. Its not a case of one is the best. Here are some samples of these available ‘boxes’. When it comes to data discovery and mobile phone investigation the phone data is fully dumped to a binary image file, we then analyse and decode the raw data. Once reconstructed we can send our customer a summary to let them know the recovery statistics as shown below.

This data can then easily be transferred to another storage device (typically a memory stick) and returned to the customer.

To Summarise

A chip-off is one of the procedures that really is a last resort. Chip-off cases are applicable when:

  • The logic board is too severely damaged to repair

  • ediscovery / digital discovery / forensic phone data recovery is required.
  • The lock on a phone if it is not known and there is no method of bypassing it via software

  • Corrosion cannot be decontaminated

  • For deleted data

The art of performing a chip-off is something that we pride ourselves on being able to achieve, we have recovered the data from many phones where this was the only option and are still carrying out these procedures today.

You can find Data Clinic at The Pavilions, Bridge Hall Lane, Bury, Greater Manchester BL9 7NX

Read More

Digital Evidence Investigation – Data Recovery and E-Discovery

As more of our lives are stored digitally, so more of this digital information is often seen as evidence. Maybe a phone contains images from a crime scene, or perhaps a hard drive contains an important email that warrants a forensic investigation of the data. One term for this is forensic data recovery.

Most data recovery companies are able to examine data forensically. Digital evidence examination basically looks at the data on a digital storage device in an attempt to discover if there is any pertinent information detailing illegal activity.

Enquiries for e-discovery (or ‘data discovery’) as it is widely known vary. Here are a few examples from clients wanting a forensic examination of their hard drives and mobile phones.

Linux ext4 formatted 2TB WD HDD that is fairly new. Will not initialise or mount. Has 1TB of films I need back as the online backup has, incredibly, failed at the same time. I have a spare drive to move the data to. I’m interested in having this data examined forensically – I think the phrase is e-discovery or examination of digital evidence.

My Seagate External Hard drive has stopped working, and the light will not light up. However it does ask for me to initialize the disk, and makes a clicking, beeping noise.

Over christmas I took a lot of video footage on my phone to make into a short movie – i put my SD card into my laptop and transferred the videos onto my desktop or iCloud, i also made folders for them on my SD card, now when i came to open the folder it has turned into an exec file which now it won’t open my videos and i fear i may have lost them! i tried to download a free software to try recover the data but it only recovered the audio and even then it was broken, i believe that the footage is still there i just need a way to bring it back, now my Mac is not recognising my SD and i don’t want to keep trying unless i cause further damage. It is only now that I realise that some of the footage may contain digital evidence of wrong doing and it may be necessary to reproduce this in a legal case. What facilities exist to examine the hard drive, SD card and phone forensically? Can you examine each of them and produce a forensic report as the what activity has taken place on each?

Read More

Retrieve stored files from OCZ in Manchester

OCZ Agility 3 SSD drive has stopped working without warning. No longer works in Mac or external drive caddy. Suspect controller fault.
Can you recover data?

OCZ Agility 3 SSD

I have an scsi external HD for my OCZ E Mu sampler SSD (music) and it’s been solid as a rock until last night where I heard it spin up… then down again: now the sampler ‘sees’ it as sleeping but it will not wake. Lights on, so power supply good. I am in Manchester M16 and need data off it/fixed or, wosrt case, at least a storage solution.

My OCZ external hard drive for a few years and has all of my work / photos on it. However, it no longer shows up when I plug it in. I have used disk utility on my Mac which is telling me it needs repaired but says it can’t be fixed when i press ‘first aid’.
I’ve ordered a new external hard drive for tomorrow in a hope that the files can be transferred from the existing one on to the new one?

I have an OCZ Hard Drive
I dropped the hard disk from office table and it stopped working
After dropping, i connected again the hard drive to computer and let if on for 30 minutes
After 30 minutes i heard a long noise
I disconnected the hard drive from computer and tried to log back again
But it gave 2 beep sounds and failed to connect
At the moment it is not working and my initial attempts to recover the data failed
I was told that the hard drive’s requires the following:
* A platter exchange is required that cleans the disk platters with alcohol solution to remove any remnants of the failed read/write heads
* Images the disk platters individually
* This procedures allows, image more sectors from the disk platters which means more data will get imaged.
Can i kindly request your help to advise whether this is possible with your service and cost of the service if possible

Read More

Hard drives are uninitialised and unallocated

In this article we discuss hard drives that have developed faults and become uninitialised or unallocated. This is quite a common problem and I’ve included some links as well to external web sites where people are having the same type of problems. These enquries come from people in West Yorkshire.

I have an external hard drive that is now coming up as uninitialized and unallocated on my PC, I have ran the WD diagnostic check and it say too many bad sectors. I have ran drill disk but it finds no files, should I assume all is lost or can you give me a price to check possibilities. I live in Sheffield, towards Barnsley

I have got a Seagate Backup Plus Portable Drive.
I was transferring pictures over from my MacBook Pro to the drive when my computer froze. I restarted my computer and then the hard drive was no longer picking up. I tried in another laptop this time Windows and still not picking up. The hard drive is now showing up as unallocated.
When the hard drive is plugged in it makes the running noise as normal but also bleeps which I haven’t heard before, it won’t initialise either.
The hard drive has not been used many times.

Since Tuesday I have been unable to access a folder on one of my uninitialised external hard drives which has very precious photographs of my children. I fear it may have a virus as I accessed a card website called funky pigeon as it was working perfectly before and the hard drive is only 3 years old and I have no back up. Could you advise please

My external hard drive (I think it is a SSD) has lost connection to the computer. I have had a friend strip it down and done everything he can do to recover the unallocated data, but was unable to read it (this is what he does as part of his job). He now states that the only way to recover the data is by using software and a data recovery company. Does this sound like something you can fix?

Data recovery on uninitialised and unallocated hard drives costs between £300 and £600 from decent clinics in West Yorkshire in places like Sheffield and Rotherham.

Read More

Mortgage Advisor Manchester Broker

In this article we discuss how to save money when applying for a mortgage. Here are some links that cover mortgage brokering and advice in and around the Greater Manchester area.

Greater Manchester

One thing about Manchester is that it’s a big place with lots of available houses to rent or buy. So the above links cover buy to let, remortgaging, home movers and first time buyers as well. When seeking a mortgage always look at the interest rate you are being quoted, just a small difference in the percentages can amount to a lot of money over a typically 25 year mortgage duration.

Read More

Mac / iPhone Recover Files

I have installed Mac OS high Sierra and ran into a problem and did a fresh install by accident. I’ve lost my files, photos and music etc. How much approximately do you charge to retrieve files etc. I have a 1 TB iMac

Macbook died via the flashing question mark folder. I managed to remove the hard drive, which still seems to work however it won’t pickup on my when plugged into my new laptop.

mac problems

My iPhone 6S is currently showing no photos on the app, after they suddenly disappeared last week. They are not backed up to iCloud. I can take photos with my camera but they do not save, and I cannot share the photos. I have tried attached my phone to my Macbook/PC to no avail. After talking to Apple, they don’t seem to know what happened. I haven’t updated my software in a while and a lot of my other apps are glitchy so that seems to be the cause however I am reluctant to update in case my photos disappear permanently. My storage shows 11GB of photos so I think they are still there somewhere – would this be something you would be able to help with?

I have a MacBook Pro and a Western Digital My Passport for Mac external Hard Drive. I have used this device as my back up. When I now plug it into my Mac it makes a noise as if the drive is spinning and a fan is on but it doesn’t show up on my desktop or in my finder. Can you please help? There are a lot of files on there that i would like recovered.

I have been locked out of my iPhone SE, it says “iPhone disabled connect to iTunes“, but this will
Restore to factory settings and I’ve not backed up. Is it possible to save the data? I know the correct passcode if that helps.

Disabled iPhone as result of entering wrong password 10 times. Not backed with iCloud. Would like to save the photos/videos on the device.

I’ve deleted sms text from my contacts. Can you retrieve them ?

Read More

Data Recovery London

I have an office PC that needs the hard drive replacing. We have the new hard drive already, we just wanted the old one removed and replacing with the new one. Would you advise on how much you would charge for this? I am most contactable via email, so please use this as a primary contact. I am able to have the drive delivered to your London data recovery offices.

I have a duel boot laptop with linux and windows. There is something wrong with the linux partition, pretty much summarized in this link https://itsfoss.com/fix-minimal-bash-line-editing-supported-grub-error-linux/.
I have tried to create a boot repair usb but it doesnt seem to work, I still get the same problem. If you can help that would be great, I can bring my laptop in this week.

london (geotagged photo)

Laptop hard drive dead and data needs to be recovered. Home laptop, but office based in Westminster (London) so can be collected from there. I believe your Lombard Street (London City) is closest but Chiswick is possible too.

2tb AV power hard drive has a broken head i believe. bought a 4tb expansion pack that a dodgy parition map i believe as that what the mac recovery thing said, there are important pictures on the 4tb that i want recovered also. I would like the 2tb recovered onto the mended 4tb drive in essence.

Pen drive used in work computer and it was encrypted by checkpoint. I can’t get it to open now on my home or new work computer. my password doesn’t work and I’m now doubting it is correct

I put a the wrong power cable in an external HDD. I burnt out the PCB. So removed 2TB 3.5 HDD (Samsung HD204UI) and put in my PC. Unfortunately it wasn’t recognised and it looks like the a single diode is burnt too. How much will it cost to fix the PCB and/or extract the data?

I have a Samsung M3 Portable 1TB external hard drive model no. HX-M101TCBG. It suffered a drop and is no longer seen by computer. Can only be found in device manager. Blue light on hard drive stays on constantly.
No grinding noise heard from drive. The hard drive is located in London.

I was making a Word file and when I tried to save it to the hard disk, it made the quiet sound it normally makes when the PC is accessing to it but this time there was a beeping sound afterwards, the whole PC froze and I turned it off. Since then, everytime I turn the PC on, the hdd beeps and the systems mentions that the hard disk didn’t initialise properly, it IS being recognised by the PC but it doesn’t shows up properly nor it can be accessed. My HDD is a 5 year old, 2000 GB Seagate Barracuda Green, it only has like 1 Tb of files and I would like to know how much would it cost me to recover those files, if possible.

Read More

Seagate recovery near Thurrock

I have a 24 year old Seagate ST15230N SCSI hard disk. I no longer have a PC with a SCSI card. The last time I ran it up was about 8 years ago and it was working fine. I don’t need data recovery, I would just like a copy of all non-windows files on the disk. Is that something you can do – and assuming the drive runs up ok can you give me a idea of cost. I’m looking for a data recovery service that based close to Thurrock in Essex (near Grays).

My ‘My Passport’ WD Ultra external hard drive is not readable by my MAC suddenly. I have used it less than a week ago.
In the meantime from my MAC I deleted loads of files that looked irrelevant.
I also went to disc utilities – synced, erased and re-set and made another WD hard drive that was empty so it was compatible with a MAC (this one was for work whereas the one that since then isn’t working is personal).
Maybe I have messed things up in the process. I just don’t want to have lost my many precious things on my own hard drive.

Thurrock church

I’m in Thurrock Essex. Can no longer access the files on the hard drive. The hard drive makes a noise when plugged in.

I have a Seagate Barracuda as a secondary disk for data that suddenly stopped working, making my computer go slow and becoming unredeable by the OS. Clearly is the case you guys describe and hopefully my data is still there. I’ve already switched it off and hopefully you guys can call me back to arrange a collection.

Sega external hard drive is not mounting and clicking. Please, can you help? Plus send me a quote for removing all the data

wd 2 TB external hard drive ,
stopped working from one day to another , used it with Imac so did a disk repair and nothing , it says ‘ invalid content in journal ,
need to retrieve some of the files inside the hard drive

Can i get a quote for 2 Western Digital external hard drives that will not connect to my laptop
One is WD1200 and one newer 1TB device

Read More

Recover / Rescue / Restore / Retrieve phone data

We deal increasingly with restoring and retrieving the files and data from mobile phones and have a good working relationship with this phone data recovery company. Here are some of the phone problems we’ve dealt with recently.

various mobile phones for data recovery
I have Nokia1020 with message: ‘Unable to find bootable option. Press any key shut down‘. So, it won’t boot at all. Would need at least photos & videos rescued. Please let me know can you do something regarding this error and estimate 8costs. I’m not in UK, but if price is reasonable I would send you the phone. Thanks in advance, Tom (Croatia)

My phone was accidentally damaged some time ago and I need to recover some video footage off it

The phone soaked in cream and as it was not possible to remove the battery it was like that for a week. After a week i got a screw driver removed the back removed the cream as much as I could dried it out as much as I could but the phone would not switch on. Tried to remove the parts and cleaned the circuits once again but still no luck. The first time when i attached it to the pc usb port the charging light came on but only for 10 secs or so. We need the videos and pictures from it.

XIAOMI redmi note 4 3GB RAM 64GB ROM MTK Helio X20 Deca Core 5.5″ FHD 4G FDD LTE

iPhone 4 or 4s. Screen smashed 3 years ago and was replaced, and worked , however the touch screen would not work with the new screen, so was unable to unlock with the password and back up to the computer , so I took the phone back to the repair shop and they removed the new screen and gave my money back. The phone has since been in my draw for 2 or 3 years, and recently we have had family deaths so would love to be able to get the photos and videos off this phone now. Not sure if the phone works , you can feel the phone battery heat up when on charge though. The phone may also be in recovery mode but not too sure.

I’ve an Android phone (Sony Experia L1) running Version 7.0. It recently ‘crashed’ on me and would not restart and was sent for a factory reset. I’m unable to accress the photos/videos and was hoping there might be a means of recovering them?

Samsung j3 pro has broke( motherboard) the phone still has contacts and some pictures on it

I have an HTC phone which they no longer sale I was on vacations and the fell into some water and i had to get another phone but i need my text messages out of it and phone want light up but it still work i think the bulb blew in it

I have an HTC phone that won’t turn on…it has been like this for 2 years now. I have tried replacing the battery. With no success. I have lots of data in including photos…but more importantly.. phone call recordings …I need recovered.

My iphone 5 has frozen in recovery mode. I have tried an update with iTunes but it failed with an error code 26. The Apple store say the only way to fix it is to restore the iphone. This will clear all data on the iphone, however, I have never performed a back-up of the phone and will lose everything.
Is it possible to recover the data, in particular photos, from the iphone before restoring it?
I don’t have a phone number as I am currently overseas on business and the iphone is frozen.

I have deleted all my pics on my iphone model A1568 ios 11.3.1. Couldn’t find backups on iCloud or using Dr. fone software. Is it possible to recover any of them?

I have an iPhone 5 that I dropped and it got stuck on the apple loading screen. Are you able to have a look at it and replace parts in order for me to get data off it?

Read More

Critical Process Has Died – Hard Drive Recovery

My hard drive was replaced last week but on the old one there are documents I would like to retain. I could enter my password as usual but nothing happened after that and a system recover was not possible. I did get a message saying a ‘critical process had died‘.

I have about 1 TB of files on an external hard drive that can not get power. It worked 3 weeks ago when i last did an update. I should mention this was in Nottingham and the power sources is fit for USA electrical outlets. I moved to the UK, tried attaching a UK adapter and no luck having it run. Sometimes you may hear a motor running and then you realize the electronic device is not fit for a different voltage and it stops. there was none of this. just quiet from the beginning. i have no way of checking what the problem could be now that im in the UK. my hard drive does not show a voltage range or process either. is the plug adapter just not appropriate or did i break it.

Nottingham

Seagate external hard drive beeps when plugged in and no data is transferred. When googles it appears the motor may be stuck. The hard drive has died and contains data for my teacher training year so it would be very useful to be able to recover the data or fix the drive.

I have a WD External Desktop Hardrive but the USB connection port is broken. The IT department at my school tried to fix the broken port but could not. The data on the hard drive is still there and it’s critical that I recover the contents. They tried placing the hard drive in another casing but as the data has some kind of protection / encryption they cannot get to it. Are you able to recover this data?

My Sony Xperia Z1 Compact has completely stopped working and I need to retrieve very important critical data from its internal storage. I have replaced the battery with a new one but nothing works.

2 x HDD Disks are from a Stora NAS drive both failed, set up as raid. Disks still spin up but cannot read them or access them. Have tried using aftermarket disk mount without success. Would like to know if you have hardware to enable reading of these disks and an approximate cost to recover data. Both discs are 1TB with about 500-750MB used. I saw an error telling me an important process has died – I need hard drive recovery – it’s critical that I get the data recovered.

I had some water damage over my MacBook Air (2013). Apple has put the storage into a safety bag, but did not comment on its condition. Wonder if your team can have a look to see if there are any issues / what it will cost to recover?

I have a Hitachi 5K250 160Gb (model number HTS542516K9SA00), with clicking noises, that is not readable.
Another company told me it’s impossible to recover data, as it is a mechanical issue. HDD was not open on this process.

I have a Buffalo Terastation showing multiple HD failures. I has a little data on it I think that I would like to keep.

I have a Lacie 2TB thunderbolt external drive that crashed. I have tried several recovery software programs but none are able to access any data from the drive. My Mac isn’t able to mount the drive- but after 15-20 min I get a message saying “the drive is unreadable- IGNORE FORMAT EJECT” I would like to know if it might be possible to recover 2 folders from this drive from one partition on the drive- I don’t need all of the data and what this would cost? I am located in Shoreditch

I was in Nottingham and one place I visited the lift doors opened to a yawning gap and in fright I dropped my bag – it fell down the shaft with my and my girlfriend’s phone plus a few other things. My phone and hard drive died so I took the brunt of it and long story short the mother board is damaged and ‘beyond repair’. Apple store says. Any suggestions if it’s possible to retrieve data / photos off of it? I really want the critical process data ie. the What’s App messages and photos from last few months – last backup to iCloud was in February (as it was full) so since then it’s just been on iTunes, on the phone. A friend of mine suggested contacting you. If you think it’s a no can do then please let me know. I can’t set up my new phone until I know as I’ll have to reset my iCloud and will lose all my other data. This is my Mum’s phone number as I don’t have one at the moment – email is best at the moment.

Read More