Chip-off NAND Extraction: Desoldering and Reading Data from the Chip

The last stop in data recovery usually leads to the same place: the device will not power on at all, the board has short-circuited, the controller smells burnt, or the circuit board is physically broken in two. When the software layer is completely gone, only one path remains, desoldering the memory chip and reading it directly. In the international digital forensics literature, this method is called chip-off. In this article we cover, in technical terms, the chip-off NAND extraction process that the DSET laboratory applies daily on its Hacettepe Teknokent Ankara line, the hardware infrastructure behind it, and the new walls introduced by modern 3D V-NAND architecture.

To see the bigger picture, we recommend first reading our general data recovery guide 2026 Turkey page. Chip-off is the most aggressive step in that chain.

What Chip-off Actually Means

Chip-off means desoldering a storage device's NAND flash chip from its carrier printed circuit board (PCB) under heat, then placing it in an external programmer to read the raw data. The theoretical basis of the operation is simple: the floating gate cells inside the NAND chip hold an electrical charge, and the controller is the intermediate layer that manages those cells. Even if the controller dies, the data in the cells stays there. What we need to do is bypass the controller and send commands directly to the chip's pins.

In practice, the job is not that clean. That is because the data inside the NAND sits there:

· Scrambled by vendor scrambling (XOR masked) · Wrapped in ECC codes · Distributed by logical-to-physical block mapping · Shifted around by wear leveling · On some modern devices, encrypted with a hardware key

In other words, when you remove the chip and take a dump, the first thing you get is a binary stream that looks meaningless. The real work begins after this point.

In Which Cases Chip-off Is Applied

Chip-off is not a cheap, fast, or routine method. The moment you remove the chip, the device is considered irreversibly dead. For this reason, at DSET we recommend chip-off only in the following situations:

· The controller chip is completely burnt, short-circuited, or laser-cracked · There is a physical break on the PCB and a normal patch will not work · The board has been blackened after fire, flood, or chemical damage (for a relevant practical case, our iPhone fell in water guide is a good reference) · The software side has collapsed, the bootloader is corrupted, and ROM mode does not respond · The device is encrypted but the AES key stayed in the controller and the controller no longer communicates · There is a digital forensics request and a raw image must be extracted without powering on the device

On the digital forensics side, ISO/IEC 27037 ("Identification, collection, acquisition and preservation of digital evidence", iso.org) and NIST SP 800-86 ("Guide to Integrating Forensic Techniques into Incident Response", nist.gov) define chip-off as destructive acquisition. That is, it should be applied only after other non-invasive methods (JTAG, ISP, in-system read) have been tried and failed.

BGA Reflow and the Thermal Profile

Modern NAND chips mostly come in BGA (Ball Grid Array) or TSOP-48 packages. eMMC and UFS chips are almost invariably BGA. BGA means a package with between 100 and 300 solder balls underneath the chip. Removing these balls and re-balling the chip is the most critical mechanical step of chip-off.

The thermal profile we apply in the DSET laboratory generally consists of the following stages:

· Preheat zone: 25 °C to 150 °C, roughly 90 seconds, with an IR heater from below · Soak zone: 150 °C to 180 °C, 60 to 90 seconds, during which the flux activates · Reflow zone: above 217 °C, with a peak of roughly 235 to 245 °C for lead-free solder, for 20 to 30 seconds · Cooling zone: a controlled drop, with no thermal shock applied

The peak temperature is set according to the chip's JEDEC J-STD-020 moisture sensitivity profile (jedec.org). The wrong profile brings death in one of two ways: either the moisture inside the chip vaporizes suddenly and a "popcorn effect" occurs (the chip swells and cracks), or the electrical charge in the floating gates partially drains under aggressive heat and the bit-flip rate skyrockets during reading.

For this step, DSET uses Quick 861DW and Atten ST-862D hot air stations, along with an IR rework station. We previously shared, in visual form, why working under a microscope is essential in our Hacettepe Teknokent laboratory microscope gallery.

NAND Types and the Difference in Reading

NAND flash is divided into four main classes according to the number of bits held per cell. This classification is defined in detail in the JEDEC and ONFI (onfi.org) specifications:

· SLC (Single Level Cell): 1 bit per cell, the most reliable, used in enterprise devices · MLC (Multi Level Cell): 2 bits per cell, older consumer SSDs · TLC (Triple Level Cell): 3 bits per cell, today's mainstream · QLC (Quad Level Cell): 4 bits per cell, cheap high-capacity SSDs

The important difference for chip-off is this: in SLC a cell holds either a 0 or a 1 voltage level, so the read tolerance is wide. In QLC the same cell must hold 16 different voltage levels, so the slightest charge loss caused by heat means a bit error. For this reason the ECC layer works far more aggressively in QLC NAND chip-off cases, and the chance of recovering data from a raw dump drops markedly between SLC and QLC. For the models we encounter most often in the field in Turkey, our frequently failing SSD models article explains this difference with case examples.

The Difference Between eMMC, UFS and Raw NAND

In the chip-off world there are three different chip classes, and their reading methods diverge significantly from one another.

Raw NAND: There are only memory cells, with the controller outside. Older USB flash drives, older Android phones, and some industrial devices fall into this class. Reading the dump is relatively easy, but reverse engineering the scrambling, ECC, and wear leveling is entirely your problem.

eMMC (embedded MultiMediaCard): The NAND and controller come together in a single BGA package, like a sandwich. It is defined by the JEDEC JESD84-B51 standard (jedec.org). What makes your life easier is this: if the controller is inside and still communicating, you can read at the logical layer by sending commands directly to the eMMC pins. This can often be done with ISP (In System Programming), the cousin of chip-off. But if the eMMC controller has also died, you have to remove the chip and treat it like raw NAND, which is far harder.

UFS (Universal Flash Storage): Defined by the JEDEC JESD220 family, it has become standard in modern Android flagships and some premium devices. It uses a serial interface, so extracting a dump requires a special UFS test socket. UFS chip-off is markedly harder than eMMC and requires a hardware investment.

Programmer Hardware

After the chip is removed, cleaned, and re-balled if necessary, it goes to the reader. The hardware widely used in the industry:

· Up-828P / Up-828 universal programmer, offering a wide library of TSOP and BGA adapters, a classic reference for raw NAND (up828.com) · RT809H EMMC-NAND flash programmer, the field standard for eMMC dumps · PC-3000 Flash the professional data recovery platform made by Ace Lab, covering the entire chain from raw NAND dump to logical reconstruction (acelab.eu.com) · VR-Table chip-off preparation tables · Various BGA152, BGA153, BGA162, BGA169, BGA221 adapter sockets

If you ask why PC-3000 Flash is critical, taking a dump does not finish the job, you have to make sense of the dump. PC-3000 Flash is one of the few platforms that does this with the help of vendor profiles. We explained in detail what the device is and why it is considered indispensable in a data recovery laboratory in our what is PC-3000 article.

After the Dump: The Truly Hard Part

You removed the chip, cleaned off the solder, seated it in the programmer, and took a raw dump. The file you get is usually gigabytes in size, a blob that looks meaningless. The real work starts now.

1. XOR descrambling: NAND manufacturers (Samsung, Toshiba/Kioxia, Micron, SK Hynix) scramble the data written to the chip with a different XOR mask on each page. This is an endurance measure designed to reduce cell-to-cell shift effects, not a malicious encryption. But to read the dump you need to know the correct vendor mask. PC-3000 Flash carries a wide library of these masks.

2. ECC decode: NAND adds a BCH- or LDPC-based error correction code to each page. When reading the dump, the ECC field of each page must be decoded and any bit errors corrected. The type and length of the ECC algorithm vary by device.

3. Logical to physical reconstruction: The controller does not write files to the chip in a particular order. Because of wear leveling, parts of the same file may be scattered across very different blocks of the chip. Without solving the logical mapping, no sensible file system emerges. This step is a separate reverse engineering job for each vendor.

4. Filesystem rebuild: Once the logical ordering is complete, file system parsers such as FAT, exFAT, EXT4, F2FS, APFS, and HFS+ are run over it.

The Apple Silicon and Secure Enclave Wall

This whole chain works up to a point. On Apple devices, especially T2-chip MacBooks and the Apple Silicon line (M1, M2, M3), there is a serious obstacle: the Secure Enclave.

On Apple, the NAND comes as BGA packages soldered onto the motherboard, yes, they can physically be removed. But everything inside the chip is encrypted with AES-256-XTS using a hardware key whose key is held inside the Secure Enclave. Even if you remove the chip and take a dump, what you have is not meaningful files but cryptographic noise. That is because the key is not on the chip, it is inside a separate security coprocessor and never leaves it.

For this reason, in Apple Silicon cases chip-off is almost never the first choice, board-level repair and in-system read attempts take priority. For the details, our MacBook data recovery T2 and Apple Silicon guide explains this limit in concrete terms.

The Challenge Brought by Modern 3D V-NAND Architecture

In old planar NAND, cells were laid out side by side in a single layer. When 2D ran out, Samsung introduced 3D V-NAND in 2013, and cells began to be stacked vertically on top of one another. Today there are products that exceed 200 layers.

For chip-off, this means three things:

· The chip is more delicate, with a narrow tolerance for mechanical shock and heat · Vendor scrambling profiles may not be present in older libraries, and new profiles change with each product generation · With QLC, signal quality drops, and in practice a raw dump cannot be read without ECC

This is pushing chip-off to become an increasingly niche and increasingly expensive technique. We covered the typical scenarios encountered on the Samsung side in our Samsung SSD data recovery article.

Vendor Scrambling Algorithms

In practice, the approaches of the four major manufacturers we see in the field are roughly as follows:

· Samsung: Uses proprietary scrambling profiles together with its own controllers (with code names like Pablo, MEX, and MGX), varying by product family · Toshiba / Kioxia: Page-based XOR together with BCH and LDPC ECC · Micron: Well documented thanks to its broad enterprise product line, with profiles widely available in the PC-3000 Flash library · SK Hynix: Dominant in the mobile eMMC market, with frequently updated scrambling schemes

Reverse engineering these profiles is not something a data recovery laboratory can do on its own, so you stay dependent on the continually updated vendor libraries of PC-3000 Flash and similar platforms.

Forensic Admissibility

When the data is to be presented as evidence in court, chip-off must be carried out with chain of custody records. The ISO/IEC 27037 and NIST SP 800-86 guidelines say, in summary:

· The device must be photographed before it is handled, and its serial number recorded · The chip removal process must be recorded (video or step-by-step photos) · After the raw dump is taken, a hash (SHA-256 is recommended) must be computed · All subsequent analysis must be done on a copy of the dump, and the original hash must not change · The entire process must be documented in a dated, signed technical report

In the DSET laboratory this chain is standard procedure for every chip-off case, and the technical report is presented in the requested format when the court requires it.

DSET Lab Practice (Qualitative)

In our laboratory at Hacettepe Teknokent Ankara, chip-off cases are handled in the following environment: anti-static (ESD) protected workbenches, calibrated hot air and IR rework stations, stereo microscopes, BGA reballing kits, a wide range of TSOP and BGA adapter sockets, and a programmer lineup that includes Up-828, RT809H, and PC-3000 Flash. Case intake always begins the same way: first a non-invasive method is tried, if in-system read fails, ISP is tried, and if that also fails, chip-off is planned as the last step and applied only after written approval is obtained from the customer.

Frequently Asked Questions (FAQ)

1. Is chip-off possible on every device? No. On Apple Silicon and T2-chip MacBooks, even if the chip is removed, the data cannot be made meaningful without the Secure Enclave key. Modern encrypted Android devices have similar limits.

2. Does the device work again after chip-off? In practice, no. Re-balling the chip and soldering it back into place is technically possible, but in data recovery cases this is outside the scope of the service.

3. How long does the process take? Chip removal takes a few hours, reading the dump 4 to 24 hours, and logical reconstruction can take a few days. If the profile is missing from the vendor library, the process takes longer.

4. What is the chip-off success rate on a QLC SSD? It is markedly lower than on SLC and MLC. Because of the heavy ECC and the narrow voltage tolerance, the bit error rate during raw dump reading is high.

5. Is chip-off always required on eMMC? No. If the eMMC controller is still communicating, reading can be done with ISP (In System Programming) without removing the chip. Chip-off is preferred when the controller is completely dead.

6. Can you give me the raw dump? In forensic and corporate cases the dump can be handed over, with chain of custody documents. In consumer cases, delivery at the file level is generally preferred.

7. Does chip-off work on a fire-damaged device? If the NAND chip itself has not burned, often yes. The real work is separating the chip from the burnt PCB without damaging it. If the chip is visually clean, the chances are high.

8. In water damage, is chip-off the first option? No. In water damage, drying and board-level cleaning are tried first. If the chip is intact, the controller may be working. Chip-off is the last step.

DSET Data Recovery · Hacettepe Teknokent Ankara

Chip-off NAND extraction is a specialty that very few laboratories in Turkey can carry out end to end. At DSET, on our Hacettepe Teknokent Ankara line, we provide this service end to end with ISO/IEC 27037-compliant forensic procedures, BGA reballing, and PC-3000 Flash-assisted logical reconstruction. If your device will not power on at all, the board is burnt, and normal methods have failed, call us before taking it anywhere else, we offer a free preliminary analysis.

Contact: +90 536 662 38 09