SSD Controller Chip Swap (SM2559XT) vs NAND Chip swap to a Donor Board

[simonboydfoley]

Hi Guys,
Q1).  Anybody know any good sites for researching SSD Data recovery ?
Q2). Anybody know if the controller's can read any NAND Memory chip (My 500GB Chip is labeled TSEF04TP3FL5K1  02145  looks like TBGA 261 pads) so I can just swap it out with a doner controller chip ?
        or is this all a waste of time because the controller chip contains the NAND Data data map tables / the encryption key changes between chip versions so the data is good as lost !
Q3). I seem to struggle to find anything other than high level technical details of the chip and  nothing about its firmware, if it can be flashed and how to programm it so I take it this is all propriatory and not publically availiable to non commercial partners ?

Normally its reccomended to move the NAND to a doner board in case a component blew the controller, rather than put the controller doner in the original board.
But in this case im sure its the controller and its a difference between reballing a 144 pad controller chip vs a 261 pad NAND Chip for a beginner.


### Background ###
I have a SATA SSD (Intergral V Series 500GB) that suddenly stopped being detected by the PC BIOS and therfore OS.
I thought this would be a good introduction into BGA reballing and SMD Electronics so I bought myself a Amscope, reballing kit and a hot plate.

I have buzzed out all the caps and resisters and they all look good.
Under a Thernal Imager and I can see no shorts and only the Controller is running hot (30C).
It all suggests that the controller is what has failed

The controller is a

SM2259XT2G AA
TF5B31  00
CH              2H

I have been trying to source a donor SSD board which will turn up in a few days.

I found a mSATA Board with a simlar controller.

SM2259XT  G  AB
PRPU20.00
TW           4D


I hope the soon to be delivered SSD Doner is teh same revision and has an identical controller.
Others I have purchased say they are the same drive but turn out to be different controllers with 4 NAND Chips not he single one I have.

[simonboydfoley]

FYI I found some information here if it helps anybody else.
https://adreca.net/NAND-Flash-Data-Recovery-Cookbook.pdf

[wraper]

Unlikely either will work as data in NAND most likely is encrypted with a key stored in original controller. Not to say unless you are using donor controller from exactly the same SSD, chance of working is near zero even if not encrypted. Controller must have suitable firmware, you cannot just take controller from some random board.

Under a Thernal Imager and I can see no shorts and only the Controller is running hot (30C)

30^oC is not hot, barely warm. Under load it can heat up to 100^oC. Did you even measure any voltages? Swapping BGA without measuring power rails would be stupid.

[simonboydfoley]

Yup I agree that 30C is not hot and what I would expect would be normal operating tempritures.
But I did not want to leave the device powered on until I have the doner board turn up and I can do a visual inspection in case any SMD components have fallen off etc and check to see if the working drive has the same tempritures.

When it does I'll power it on and check all the voltages from the 3.3V, 5V & 12V rails and compare it to the donor board and see if any of the fuses have issues.
However it all looks like the controller chip has failed.
There is what appears to be via pads for a 8 pin JTAG port and a couple of jumper via pads one of which is probably a firmware/factory mode.
But I obvioulsy need to get some reasearch on the board layout to figure out what I am doing.

If its the controller I doubt factory mode will get the device detected by the BIOS.

### Realistic plan of action ###

Then if I still see it as a failed Controller chip, i'll swap the controller chip on the SATA drive with the mSATA Board Controller chip and hope the keys are the same.
If that fails, ill then simply swap the NAND chips onto the doner SATA Drive that will turn up today and hope that works if the layout is compatable.

There are difference in boards even though the product name and version say they are the same.
My Failed SSD is a v2 that was a 1TB SSD Board where they only populated one of the 500GB NAND Sockets.

Other doner boards I have ordered revert to a cheaper 4 or 2 Chip boards and different controllers even though the product name and version numbers advertised are the same as my device.

Chances are that the keys are different and hence the reason why companies can charge 8000 Euro for toolkits that build up inventories of keys to recover data and prevent self repair.

Anyway this is all a educational project.

I'll post progress with photos when my doner board arrives so others can learn from my experiment :-)

Update: The donor drive again turned up with the red lable not the yellow/green one advertised and it is based on a Phison Controller with 8 64GB NAND Chips !!