How we do a ‘Chip-Off’ Forensic Data Recovery on a Mobile Phone

Forensic data recovery and mobile phone investigation is the process of salvaging data from failed storage devices such as mobile phones or hard drives. We offer our services across a wide range of devices. Here we will look at our mobile phone side of the company, more specifically what is known as a chip-off operation. Chip off is a useful technique especially in forensic data recovery, also known as digital discovery, or eDiscovery: these are methods of data investigation used by police forces and insurance underwriters. Data Clinic Ltd are experts in recovering data from damaged phones and hard drives.

With any mobile phone or tablet, we initially attempt to inspect the phone, we determine if the failure is with the peripheral components such as batteries, charging ports and screens. If this is the case, then we wouldn’t need to go any further. For a lot of ediscovery data investigations cases however, this option serves as a process of elimination and if this first attempt of recovering the data is unsuccessful then we look at the more advanced options available to us. This is typically in the form of advanced micro soldering, JTAG or a Chip-Off operation.

So, what is a ‘Chip-Off’?

A Chip-off is the process of de-soldering the Flash Memory chip from the failed phone / tablet in the hope that we will successfully read its raw data independent of the device.

How do we do a Chip-Off recovery?

In order to complete a forensic data recovery on a mobile phone it’s first necessary to determine that a Chip-Off on a phone / tablet is needed then the next step is preparation. The phone must be fully dismantled, including the removal of any protective metal heat shields. When this is done we identify the eMMC (or NAND) memory chip place the PCB into a special holder underneath our stereo microscope as shown here.

What is now needed to remove any underfill from around the memory chip and add specialist flux to the chip. The Flux we typically use is Amtech Tacky Flux – the idea with this is to dispense it all around the chip then apply heat to it.

The main heat application we use is a Quick 861DA heat gun (image below). This is a station that offers a wide range of options when it comes to applying heat. We make sure to select a correct temperature, airflow and nozzle to do the job properly.

Once the chip has been lifted from the board after carefully applying the correct amount of heat we get the de-soldered chip, we then proceed to cleaning and re-balling the chip. This is a meticulous process whereby we need to ensure that each of the 100+ solder contacts have clean solder. It is a manual process that you need skill in precision soldering and a keen eye under the microscope to do.

Once each pin has been successfully and soldered in a uniform manner, it is time to clean it up with specialist chemical solutions. This ensures that the contacts are as clean as they can be and thus the read of the chip should also be good!

There are a lot of readers and programmers available worldwide that you can use to read the raw data of an eMMC NAND memory chip. The honest answer is they all have different capabilities for different chips. Its not a case of one is the best. Here are some samples of these available ‘boxes’. When it comes to data discovery and mobile phone investigation the phone data is fully dumped to a binary image file, we then analyse and decode the raw data. Once reconstructed we can send our customer a summary to let them know the recovery statistics as shown below.

This data can then easily be transferred to another storage device (typically a memory stick) and returned to the customer.

To Summarise

A chip-off is one of the procedures that really is a last resort. Chip-off cases are applicable when:

  • The logic board is too severely damaged to repair

  • ediscovery / digital discovery / forensic phone data recovery is required.
  • The lock on a phone if it is not known and there is no method of bypassing it via software

  • Corrosion cannot be decontaminated

  • For deleted data

The art of performing a chip-off is something that we pride ourselves on being able to achieve, we have recovered the data from many phones where this was the only option and are still carrying out these procedures today.

You can find Data Clinic at The Pavilions, Bridge Hall Lane, Bury, Greater Manchester BL9 7NX

Read More

Data recovery for Lightroom user

Here’s an interesting data recovery enquiry I had from a professional photographer based in Wigan. I passed this enquiry onto the people at http://data-recovery-tips.co.uk/ who were able to get the data back.

Wigan

I have a 1 TB Transcend Storejet external HD no more than 4 months old. I was using it yesterday to run my lightroom catalogue whilst editing photos on my Macbook Pro and a strange error message came up (loads of commas and random letters) and Lightroom crashed and my Hardrive kind of froze (it wouldn’t eject but the symbol was still on my desktop). Ive tried plugging the hard rive into two different mac book pros, my iMac and changed cables aden the problem doesn’t change — it isn’t recognised, there is no sign of it at all. It has life as the blue power light is on on the hard rive but it is a continue light rather than flickering slightly like usual. Would like to try and recover the stuff on there and if possible get it working again.

Another one of my devices also needs sorting out: My HP Pavilion 15-b135ea Sleekbook had coffee spilled onto it, I then dried it out. The laptop then worked briefly, but now when I power it on it displays:
Boot Device Not Found
Please install an operating system on your hard disk.
Hard disk (3F0)
I pressed F2 for system diagnostics and ran a memory test, which was passed. I then ran a quick hard drive check which said:
SMART Check : Not installed
Short DST : Not installed
Then I ran an extensive hard drive check:
SMART Check : Not installed
Long DST : Not installed

This is the machine that I run Lightroom from, so not only do I need my data recovering from the Transcend hard drive I also need the laptop sorting out – do you think you can recover the data and get the laptop working again? I am in Wigan, Lancashire and can call in to see you if required.

Read More

Hard Disk Drive Recovery

6 instances of real data recovery worries from broken hard disk drives in this post, with links added where necessary. For more info, just contact me.

Sandisk Ultra II 480GB SSD failed out of the blue (came home to a black screen on my PC whilst it was on). The SSD does not show up on any PC in an OS or in the BIOS/UEFI. No updates were done to the firmware recently and no issues had occurred until today. Seems to be a sudden failure. The drive is about 18 months old only.

I have a toshiba external tg hard drive with auto back up disabled. It was connected to a MacBook pro while running a script when the MacBook Pro battery ran out and shut down. Since then my hard drive will not work on windows or mac. It calls it a local disk not its actual name. The first attempt gave an Error message of parameters. Subsequent error messages say corrupted and unreadable. It is missing the bar to say usage. When you select the properties, it says 0bytes used when before there was between 250 and 500gb. I haven’t run a check on it or any repairs for fear of causing more damage.

Disk is fully functional. I am attempting to recover data from a previous pc user who has deleted files. Another user has subsequently been set up on the pc along with software installs causing overwrites. Regular undelete programs have revealed lots of overwritten files and very little recoverable. Is this something you can help with?

Boss br1600I’ve left my external hard drive drop on the floor and since then it’s not reading anymore. It’s making a ticking and sound noises.
I’ve tried loads of times and nothing. I had a friend that had a quick look and he said that I should contact an specialist.
I have all of my work and personal stuff in there.
I would like to know if you guys could help me with that.

I have an old Maxtor external hard drive that backed up an old pc that broke. I would like to retrieve the data on it (namely photos and some old business files).
I live in Scarborough, but am in Leeds next Friday at St James’s hospital. I could drop it off after the appointment? Or I could post it – which ever is easiest.

I had two external drives attached to my iMac. I was using terminal to erase/format JHFS+ on disk4 but it couldn’t find the disk and appeared to move on and erased disk3. I have scanned it a couple of times with recovery programs but have not yet taken any action because the files I need most don’t show up. They are *.BR2 and *.VR8 files generated by a Boss Digital Recording Studio BR1600. What are my chance of getting a complete undelete? One of the scans showed up about 700k files but only the easy ones MP3,MP4,Doc,XLXS,Numbers,Pages etc. Also what is the likely cost if it is reversible?

Read More

SSD Data Recovery

In this post we look at SSD hard drive recovery services, using a customer enquiry as a question.

SSD hard drive“My laptop recently stopped working, I think it was something due to a little bit of beer being dropped onto the keyboard of my MacBook Pro. I took it into repair at PC world as I was insured however they have been unable to rescue the data. Instead they have returned the SSD drive to me. I was wandering.. there doesn’t seem to be any physical damage to the SSD and I have lots of important university work which I wish to retrieve. Can you advise me further as to the likelihood of my data being rescued. I have been recommended using an SSD recovery service like http://www.dataclinic.co.uk/ssd-data-recovery/ and wonder if you have any idea to how much this is likely to cost?”

The Data Clinic service you describe above is a good one. The company have been operating for some time and have built up quite a reputation as experts in data recovery. I don’t know their exact prices but you can expect to pay around £500 for their data recovery services.

Companies like Data Clinic don’t repair hard drives – instead they retrieve the data from them and put it on something else, such as another hard drive or memory stick. I know that they are a UK wide company with branches in most of the larger UK cities such as Liverpool, London and Glasgow.

Read More

Help Required With Getting the Data off of Phones

Been locked out of my phone, I have tried everything to no avail to bypass my Samsung note 5 without factory reset because I have so much memories on it which I can’t afford to lose, can you help??

I was just wondering how much it would cost to get data recovery from a Nexus 5x phone? I just want the photos extracted. The phone has been water damaged. How much will the data retrieval cost? I would also like to see if the phone can be saved/fixed. How much will that cost?

deleted 400 photos and videos and unable to get remaining photos off phone

I had a Samsung galaxy a3 and I dropped the phone, so the home button fell out and then condensation went into the phone and the screen went black. The phone was still working as i could have hear notifications but couldn’t see anything. So now I have lost many many pictures on there from travelling round Thailand which I desperately want to get back but can’t get them off my phone myself because it is pin locked. I woukd be so grateful if you guys could help me get my photos and videos back.

My iPhone 5s has broken and so far no one has been able to fix it. When I went into iPhone they advised the pictures I had on the phone were backed up…these haven’t picked up on my new phone. I’m not sure if it’s because it’s a different iCloud account and I’ve maybe set up a few? I can’t remember what the Apple ID is for the broken phone and I’d really like the pictures that were taken on it.

My iPhone suffered an iOS failure and needs to be restored. Unfortunately I have a lot of important data on the phone that needs to be recovered before I do this. Could you please give me an estimate of how much it will cost to recover the data from my phone, and approximately how long this will take? As this is my only phone, I need to have this sorted (so I can restore the phone) as soon as possible.

I have two phones which both have data on them which I would like recovered.
Can you please advise me of the cost of this?

I make yesterday for my stupid back up phone to factory setting I was pretty sure I have extra memory in my phone so all picture for last 3 months are on extra memory but I was wrong so I lost all my picture and now I would like to recovery them I understand You will not be abel to recovery 100% but more important for me is get the same resolutions of pictures phone after back and realised I lost all photo I switch off till now phone is Samsung S7 edge my post code is me8 6au I would like to ask for the price because 250£ like I read on your website its bit of to much for me

Read More

Help with phones, ransomware and data recovery

I need help here. My laptop has been infected with a malacious virus called ransomware, everything on the lap is encrypted. could you fix it?

Sony M4 Xperia Mobile Phone – Been dropped and has vibration damage to the interior, and power is getting/ going/ registering with the mother board, and therefore cannot access the chip. Wish just to recover PHOTOS/ VIDEOS only. Phone has been examined by another company, however charged were very expensive, hence the description above.

I have a 1tb G-Tech Thunderbolt/USB 3.0 hard drive. Recently it stopped working as I was using it with Pro Tools and shut down the computer. When I restarted the computer I went into Disk Utility to try and repair the drive but as it was doing this it shut down the computer again. I can now see the drive in Finder and Disk Utility but when I double click on the drive it opens a new finder window and sometimes freezes. The rest of the time it will let me see the front face of the drive but nothing else. When I try to copy data to a different drive it freezes again and sometimes shuts the computer down.

Problem is with my iPhone 5c.
I forgot my pincode so cannot get into the phone to get my photos & videos from it. I no longer use this phone as I now have another phone but I desperately want my photos & videos from this phone.
The phone is in full working order I just can’t get into it.

Can see drive in the drives list but can’t access folders and can’t copy them as windows explorer and folders get frozen after I touch any folder. My external device doesnt show up on my macbook or any of my laptops. it used to show up and now it doesnt, sometimes it gets recognised by my macbook air utility. this problem just recently started, i have a lot of data on there that i do not want to lose

External hard drive not working. Once connected to any laptop it’s not connecting to laptop. Have tried it on 2 laptops and 1 desktop at home. Had a local repairer look at it and he said he can’t fix it.
The external hard drive has really important stuff on it, more sentimental stuff and really hope you can help.

Hard drive was showing files but then would go blank on and off. I tried to copy folders from one hard drive to another and it worked with one folder. Now my mac is not registering/recognising the hard drive when I plug it in.

Its turning on but wont let me log on.

I recently had my phone stolen and also had it recovered by the police. I ordered a replacement sim from Tesco however my phone would not work properly for weeks – could not call/text anyone. I finally resorted to taking my phone into Tesco to ask for help. They did a factory reset whilst I was in there and it was only afterwards that I had realised that my dissertation interview recordings were on my phone – in the voice recording app which I did while my IMEI was barred. I have since managed to get the phone unbarred and it now works – however my phone has been constantly restarted during this time. I have tried using both Dr. Fone recovery (did not recognise my phone at all) and Gihosoft (did not find the audio clips nor anything else – just what is on the phone now) with no luck. Do you think there is anyway it can be recovered please? Any chance you can email me a response please rather than a phone call as I have poor signal in my flat.

My 3TB Western Digital My Passport Drive received a hard knock and now displays classic clicking sound of the heads failing to read the disk and the actuator assembly arm jumping back to it’s parked position. The drive does not mount up.

i was in the process of creating an external boot usb drive for windows 10, The installer spent around 6 hours downloading a version of windows, during that time i attached my 500GB external drive to the laptop to move files and photos etc to the external drive. When windows finished downloading, the installer decided it would use my external hard drive as the boot drive and appears to have formatted it as a 32GB drive and all my files appear to be gone.
Is there any chance you would be able to undo this mess that windows made or be able to recover the files? I believe the drive was around half full.

Read More

Latest Q&A

Seagate Barracuda 7200.12 500Gb installed as 2nd hard drive in a Windows PC.
Cooling fan in power supply failed leading to increased case temperature and possibly incorrect voltages.
Power Supply replaced.
Took longer and longer for files to appear in Windows Explorer. Eventually the hard drive stopped working.
Bought a replacement PC and tried installing the hard drive. It was found by the BIOS at initial boot but failed to be found by Windows.

I have a USB drive that is bent and no longer works. This was achieved by leaving the USB in the computer and the computer falling off the bed, landing on the USB stick. The computer can no longer detect the USB whatsoever. If i sent the USB in to repair, how long would the repair usually take? I really need it repairing by Thursday (20th Oct 2016).

I have 2 WD external drives that are both at least 5 years old.
They are (I think) 1.5 & 2TB in size.
When I connect them to the mac, I can no longer hear them spin up & they do not appear as connected drives.
From this I assume they have both failed.

Drive has stopped responding and cant be seen by the computer. I have also tried it in a USB enclosure and no joy.
Its a 2 TB Seagate drive around 2 years old and has loads of pictures, music, videos and other files on it
Model: ST2000DX001

I own Seagate 3TB drive from airport extreme router.
Disk failed. I opened the drive in clean room and saw that head is bad and need donor or replacement. What’s the price for that service ? Better for me is just to read platters if that’s possible.

I have an issues with a failed hard drive that will no longer spin. It’s a Seagate ‘Laptop Thin SSHD‘ 500GB (PN: 1EJ162-038).
When plugging the drive in it no longer spins up so we’re unable to retrieve anything off it. Do you think you could help? Any idea of the potential cost?

Read More

External Hard Drive Stopped Working

Here’s a question we received about and old hard drive that recently died.

Dead hard drive“My old (~10 years old) external hard drive stopped working recently. I have tried to open it and connect the hard disk direclty to my computer but it did not work. My hard disk didn’t even start spinning.
Could you please tell me how long and how much it would take to recover the data that are on it?
Here are the details of my hard drive, I am in Coventry:

  • Iomega UltraMax Desktop Hard Disk Drive
  • 500GB Capacity
  • Interface: FireWire 400 (1394a) • USB 2.0
  • 7200 rpm Spindle Speed
  • 8MB data buffer”

Actually the Iomega Ultramax is an external hard drive, rather than a desktop type hard drive. To attempt to remove confusion, ‘desktop’ hard drives are the devices that you find inside desktop computers – you don’t see them as they are inside the computer case. ‘External’ hard drives are those that are external to the computer and are usually connected to it by either a USB or Firewire cable. They are also called ‘portable’ or ‘usb’ or ‘firewire’ hard drives. So even though these external devices frequently sit on a desktop, they are not referred to as desktop drives. A good example of one of these drives is the Western Digital series of My Passport disks.

From the problems you describe above it actually doesn’t sound too bad a fault, and should be easily rectifiable. The key part of your description is where you explain that the hard disk didn’t even start spinning when it was directly connected to a computer. Although it may sound a minor point, it enables me to identify the you’ve most probably got a problem with the electronics on the hard drive, rather than the mechanics, firmware or data. Once a solution is found, the data should be fully retrievable. The best advice would be for you to contact an external hard drive recovery company who should be able to sort the problem out and retrieve the data from the hard drive for you.

Electrical problems on hard drives usually revolve around the circuit board. Although robust, these are easily damaged by power fluctuations and spikes which can destroy a controller board. Fitting a new controller board to the hard drive is often the first thing most of us think about doing, but this will not work as some of the components on the original controller board contain unique ‘adaptive data’ about the hard drive and also need to transplanted onto the new controller board before the hard drive will start to work properly again.

Read More