12 January 2017

Extracting files from water damaged phone using chip-off method

I managed to drop my phone in saltwater which completely broke it. After soaking in isopropyl, careful cleaning of rust and drying out for weeks, the phone did not even react to plugging in the charger. The files, and most importantly photos that had not synced to the cloud yet, were all trapped inside the dead phone.

I tried to find a service that could recover the data, but the service providers i found were either non-responsive or costed ridiculous amount of money for them to even try recovering files. I ended up buying a eMMC reader myself and desoldered the memory chip from the phone and recovered the files. Fortunately i had not encrypted the storage on my phone, otherwise it would have been much harder to get the images out of the encrypted chip.

It turns out that the android phone i had (Sony Xperia Z5 compact, not so waterproof as they let you think in the commercial..) stores all the files in the phone on a 11.5x13mm eMMC chip which looks like this:

Apparently the eMMC cards use the same standard as ordinary SD cards, so it is possible to build a eMMC-SD adaptor and just read the SD card in your normal SD card reader. The just requires you to attach the SD card contacts to the correct connectors on the eMMC chip. The connectors on the underside of the chip are way too small for me to be able to solder wires to them:




I decided to buy an adapter and found various places to buy them. Often they would cost $200-$300, but i found a store that sold them for only $99 (https://kzt-socket.aliexpress.com) and i took a chance and ordered it.


At first i must have done something wrong, i could not get the computer to recognize the reader. I had bought a couple of new eMMC chips to try things out with. Being a little sad that the expensive reader i had bought did not work, i let the project rest for almost a year before taking it up again. When i took it up again i got it to work on the first try, so i have no idea why it did not work the first time.. 

After establishing that the reader worked, i took out an old phone i had (LG G3) which turned out to have the same type of eMMC chip, and i made my first attempt to desolder the chip and read it. The first try failed, i could not read the chip in the reader. I think i heated it up too much and simply broke it. The next try (an broken Nexus 5) i did a bit more research on. This chip worked after desoldering it, so i felt confident enough (and fresh out of phones) to try it on the phone where my photos were.


I finally had a reason to buy a heat gun :)


I found where the eMMC chip is located.


Set the heat gun to 200C and let it heat up.


Then aim it straight at the eMMC chip and let it heat it for 60 seconds. This will make sure the chip is heated all the way through to the solder points below it before you turn up the heat even more. If you don't want to damage the other components, it's recommended to heat up the whole board evenly, but i was only interested in removing the eMMC chip.


 When 60 seconds of 200C have passed, increase the temperature to 400C and heat the chip for 30 seconds with it. This will melt the solder and the chip will be free.


Almost at least, there is also some glue underneath the chip that will require some prying to get loose. It's not too hard attached though, so a small flat screwdriver did the job without damaging the chip.


Tada, the chip is now off!


It was not the prettiest chip right after removing it. There were still some solder left that shorted some of the pins, the there were glue residue everywhere.


I took out my soldering iron and put on the flat solder head.


Heated it up to ~350C and started cleaning the chip.


First i applied some solder flux.


Then i just scraped the surface, not super hard, of the chip and removed all old solder points and glue residue until the surface was smooth enough to not interfere with the eMMC reader.


When the chip was clean i could just pop it into the reader and connect it to the computer and it showed up as a SD card in my file browser. After that it was just a matter of copying the photos to the computer.