Removing/Decapping an epoxy blob

[Halcyon]

I have a need to get at a chip underneath a blob of epoxy. The epoxy itself has a matte finish, as opposed to the glossy type you generally find in calculators etc... but otherwise is of the same "blobby" appearance.

Is there anything I can do to safely get to the chip underneath, in this case it's a NAND chip, without damaging the chip itself?

[Rerouter]

Its not easy, even with the proper stuff (fuming nitric acid) Its very hard to not damage bond wires unless you have had many practice runs, not to mention it is not a chemical you want to have unless you understand its risks

One thing you may be able to try if it is a grey epoxy would be soaking in an agressive solvent like MEK (Methy Ethyl Ketone), It will not make it dissapear, but soften it enough that you can start to clean it off with other methods a few 10's of microns at a time (have done it this way for some boards I had to repair, took 1 night and 1 day, let it soak, when i had time, used a sacrificial tooth brush to scrub off some more of the epoxy, put it back in and so on, if you do it this way, do not store the toothbrush in with the solvent while waiting)

Is the reason for accessing the nand chip data recovery, or curiousity? this will change things a fair bit, Equally when you say damage the chip, do you want it to stay functional, or just a complete silicon die.

[frozenfrogz]

Some epoxies soften when heated. Try hitting it with hot air (150°C) and see if it softens.
The stuff used to bury bare ICs usually tends to be some tough MFer though.
If you really need to get a detailed look on the chip, I would recommend xraying.
Since the epoxy is designed to stick to the die and bond wires, every crack in the epoxy means potential cracking of the die.

[Halcyon]

Some epoxies soften when heated. Try hitting it with hot air (150°C) and see if it softens.
The stuff used to bury bare ICs usually tends to be some tough MFer though.
If you really need to get a detailed look on the chip, I would recommend xraying.
Since the epoxy is designed to stick to the die and bond wires, every crack in the epoxy means potential cracking of the die.

I tried a hot air station set to 300°C. The epoxy held on fast.
I not only need to look at the chip, but I need to access the pins/bond wires so an x-ray won't help me other than to confirm whether the chip inside is cracked or not.

Its not easy, even with the proper stuff (fuming nitric acid) Its very hard to not damage bond wires unless you have had many practice runs, not to mention it is not a chemical you want to have unless you understand its risks

One thing you may be able to try if it is a grey epoxy would be soaking in an agressive solvent like MEK (Methy Ethyl Ketone), It will not make it dissapear, but soften it enough that you can start to clean it off with other methods a few 10's of microns at a time (have done it this way for some boards I had to repair, took 1 night and 1 day, let it soak, when i had time, used a sacrificial tooth brush to scrub off some more of the epoxy, put it back in and so on, if you do it this way, do not store the toothbrush in with the solvent while waiting)

Is the reason for accessing the nand chip data recovery, or curiousity? this will change things a fair bit, Equally when you say damage the chip, do you want it to stay functional, or just a complete silicon die.

It's a black epoxy. I don't really want to start using acids.

Data recovery purposes. It's not *that* critical. It's important, but not so important to spend days or a lot of money doing it. Part of it is to practice my methods as well.
I confirmed that it's not the controller, I swapped that chip with a known-good one and same issues.

[Rerouter]

black epoxy that is stable at high temperatures, At this point I can only recommend the slow solvent method, at a guess its a more chemically inert one than the one I mentioned, but it will slowly break down. Buy some MEK or Methylene chloride and take the slow road, If you want it somewhat automated, put it on something to slosh the solvent back and forth over the area, This way the bond wires should not be damaged,

Just be aware mechanical abrasion speeds up the process a whole lot, but if you need every bond wire intact, then you need to go slow. and not do anything that could tear a bond wire.

Equally both these solvents will eat through just about any plastic that sees either the liquid of the vapour, so plan where you want this to happen, and use metal containers where possible.

[magic]

They are tough mfers indeed. I once tried dichloromethane, which I found listed together with MEK and toluene as possible epoxy solvents, but it did nothing to the chips I tried. I left them soaked for two days only to discover that DCM is capable of escaping HDPE containers, apparently by diffusion
The only method I know which doesn't involve acid is heating to 500-600C to release the magic smoke which holds this epoxy together. But this is guaranteed to kill the chip (I tried).

I would investigate the possibility of removing the controller chip and accessing the flash though the controller's PCB pads.

[Halcyon]

I would investigate the possibility of removing the controller chip and accessing the flash though the controller's PCB pads.

You raise an excellent point. I might give this a go.

[frozenfrogz]

If access to the pads / bond wires is the prime directive, maybe also consider removing the PCB from the back instead of the epoxy blob.
You might be able to sand down the PCB just to the point where the back of the traces is exposed.
Start with 320 grit and then switch to wet sanding paper before exposing the copper layer.

[Zero999]

Some epoxies soften when heated. Try hitting it with hot air (150°C) and see if it softens.
The stuff used to bury bare ICs usually tends to be some tough MFer though.
If you really need to get a detailed look on the chip, I would recommend xraying.
Since the epoxy is designed to stick to the die and bond wires, every crack in the epoxy means potential cracking of the die.

I tried a hot air station set to 300°C. The epoxy held on fast.
I not only need to look at the chip, but I need to access the pins/bond wires so an x-ray won't help me other than to confirm whether the chip inside is cracked or not.

Its not easy, even with the proper stuff (fuming nitric acid) Its very hard to not damage bond wires unless you have had many practice runs, not to mention it is not a chemical you want to have unless you understand its risks

One thing you may be able to try if it is a grey epoxy would be soaking in an agressive solvent like MEK (Methy Ethyl Ketone), It will not make it dissapear, but soften it enough that you can start to clean it off with other methods a few 10's of microns at a time (have done it this way for some boards I had to repair, took 1 night and 1 day, let it soak, when i had time, used a sacrificial tooth brush to scrub off some more of the epoxy, put it back in and so on, if you do it this way, do not store the toothbrush in with the solvent while waiting)

Is the reason for accessing the nand chip data recovery, or curiousity? this will change things a fair bit, Equally when you say damage the chip, do you want it to stay functional, or just a complete silicon die.

It's a black epoxy. I don't really want to start using acids.

Data recovery purposes. It's not *that* critical. It's important, but not so important to spend days or a lot of money doing it. Part of it is to practice my methods as well.
I confirmed that it's not the controller, I swapped that chip with a known-good one and same issues.

You you want to dump the contents of the flash memory?

Is this something you designed yourself?

I don't know, isn't there a risk high temperatures can cause data loss?

Perhaps the manufacturer can help.

[amyk]

Matte finish suggests it's probably glass-filled epoxy.

The requirement to preserve both the PCB and bond wires makes this much trickier... if you only needed the die intact (and could bond it onto something else afterwards), there are many other solvents that would work to dissolve everything else.

[Halcyon]

You you want to dump the contents of the flash memory?

Is this something you designed yourself?

I don't know, isn't there a risk high temperatures can cause data loss?

Perhaps the manufacturer can help.

No it's not. It's a cheap and nasty USB key made in China. No idea who makes it or where it comes from. There are no descriptive markings on either the shell or the PCB. To be honest, I'm not surprised it failed.

Matte finish suggests it's probably glass-filled epoxy.

The requirement to preserve both the PCB and bond wires makes this much trickier... if you only needed the die intact (and could bond it onto something else afterwards), there are many other solvents that would work to dissolve everything else.

This is a possibility (to bond the wires again later) but it's probably going to more effort than it's worth. The person who owns this should have backed up their data and not relied on a free give-away USB drive.

[Benta]

The only substance I've had any luck with in dissolving epoxy is acetic acid. It converts the epoxy to brittle dust, but it takes quite some time (days). It needs to be used right on the spot, otherwise neighboring parts or the PCB may be damaged, so some kind of containment structure is necessary.

[magic]

That's interesting, I'd like to try it.
Room temperature, I suppose. What concentration?
How did it affect metal like exposed bonding pads on the die, bonding wires, etc?

[Benta]

That's interesting, I'd like to try it.
Room temperature, I suppose. What concentration?
How did it affect metal like exposed bonding pads on the die, bonding wires, etc?

Room temperature, yes. Careful, it's flammable.
100% concentration.
It doesn't really attack metal, but can leave a residue or a surface oxidation.

EDIT: additives to the epoxy, like glass or other stuff may inhibit the process.

[jayeye]

Before we start, I hope someone learned a lesson about the value of backups. Who keeps valuable data in a single location? Unless, of course, these are not *your* data, but I digress

Normally the reason to expose a chip is to get access to its insides in a way that cannot be done by just accessing the bonding pads, which can be done by careful sanding of the outer layers of the epoxy. A prerequisite for that is knowing the layout of the chip. If you have only one copy, *and* you don't know what's inside, *and* you don't know which pads do what, *and* you want a copy of the data, I'd say forget it. Still, if this were the key to a billion dollars, here's what I would do:

First, ask my dentist to take an xray, with the film as close to the back of the chip as possible. Another poster's suggestion to lap the PCB to get to the traces also applies here. In the unlikely event that this is a multi-layer PCB, keep track of exposed inner layers and where they go. I'd definitely want to get rid of all copper before I xray it, for best results.

The xray would also tell me if there is any tamper-resistance built into the package. If there is, I have friends who have done this before and I would go to them for help; without A LOT of prior experience there is no way I would get past even the simplest TR protections, and it would only be worth it if national-security-level interests were at stake.

Unless I got lucky and the epoxy is some inferior material, I would not even attempt to use any organic solvent. Hot WFNA it would be. Now, my parents were chemists, so I learned how to handle things like white fuming nitric acid (WFNA) as a kid, but that stuff is DANGEROUS, and common sense won't save you -- there is nothing commonsensical about the stuff. Then there is the problem of acquiring it and having it shipped to your location without getting on all sorts of watch lists

There can't have been only one of these things made. How did you get it? Why can't you get more?

[apis]

Wouldn't there be a risk that x-rays potentially flip memory bits and corrupt the data?

[Halcyon]

Before we start, I hope someone learned a lesson about the value of backups. Who keeps valuable data in a single location? Unless, of course, these are not *your* data, but I digress

I think someone did. Thankfully that someone isn't me. :-)

There can't have been only one of these things made. How did you get it? Why can't you get more?

I have obtained donor drives of identical type/batch.

Already this is looking like it's going to be too difficult for the amount of possible gain. I don't have days or weeks to spend on it. I think I'm just going to have to leave it there. I've tried all the "quick" things I can think of.

[frozenfrogz]

Would you mind sharing a picture or two and the full prerequisit?
This changed from guessing you want to obtain a chip layout to 'me needs to access data'.
Maybe there is a way you did not think of, but we are somewhat left to pokeing at it with a stick without a chance to understand the actual task.

[Zero999]

That's interesting, I'd like to try it.
Room temperature, I suppose. What concentration?
How did it affect metal like exposed bonding pads on the die, bonding wires, etc?

Room temperature, yes. Careful, it's flammable.
100% concentration.
It doesn't really attack metal, but can leave a residue or a surface oxidation.

EDIT: additives to the epoxy, like glass or other stuff may inhibit the process.

Be careful, 100% concentration acetic acid is much stronger than ordinary vinegar. It's very corrosive and can cause severe burns to the skin and eyes and the vapour can cause damage to the respiratory tract. Where all the necessary protective clothing and use in a well ventilated area.

[HalFET]

They are tough mfers indeed. I once tried dichloromethane, which I found listed together with MEK and toluene as possible epoxy solvents, but it did nothing to the chips I tried. I left them soaked for two days only to discover that DCM is capable of escaping HDPE containers, apparently by diffusion
The only method I know which doesn't involve acid is heating to 500-600C to release the magic smoke which holds this epoxy together. But this is guaranteed to kill the chip (I tried).

I would investigate the possibility of removing the controller chip and accessing the flash though the controller's PCB pads.

DCM on its own often doesn't get the job done, most commercial removers also throw in some dimethylformamide (DMF). Not sure what it exactly does, it does seem to make it more effective.

[magic]

Maybe because

DMF penetrates most plastics and makes them swell. Because of this property DMF is suitable for solid phase peptide synthesis and as a component of paint strippers.

I didn't know about it and used pure DCM.

[HalFET]

Maybe because

DMF penetrates most plastics and makes them swell. Because of this property DMF is suitable for solid phase peptide synthesis and as a component of paint strippers.

I didn't know about it and used pure DCM.

That would definitely explain it!

[coppercone2]

Before we start, I hope someone learned a lesson about the value of backups. Who keeps valuable data in a single location? Unless, of course, these are not *your* data, but I digress

Normally the reason to expose a chip is to get access to its insides in a way that cannot be done by just accessing the bonding pads, which can be done by careful sanding of the outer layers of the epoxy. A prerequisite for that is knowing the layout of the chip. If you have only one copy, *and* you don't know what's inside, *and* you don't know which pads do what, *and* you want a copy of the data, I'd say forget it. Still, if this were the key to a billion dollars, here's what I would do:

First, ask my dentist to take an xray, with the film as close to the back of the chip as possible. Another poster's suggestion to lap the PCB to get to the traces also applies here. In the unlikely event that this is a multi-layer PCB, keep track of exposed inner layers and where they go. I'd definitely want to get rid of all copper before I xray it, for best results.

The xray would also tell me if there is any tamper-resistance built into the package. If there is, I have friends who have done this before and I would go to them for help; without A LOT of prior experience there is no way I would get past even the simplest TR protections, and it would only be worth it if national-security-level interests were at stake.

Unless I got lucky and the epoxy is some inferior material, I would not even attempt to use any organic solvent. Hot WFNA it would be. Now, my parents were chemists, so I learned how to handle things like white fuming nitric acid (WFNA) as a kid, but that stuff is DANGEROUS, and common sense won't save you -- there is nothing commonsensical about the stuff. Then there is the problem of acquiring it and having it shipped to your location without getting on all sorts of watch lists

There can't have been only one of these things made. How did you get it? Why can't you get more?

relax with the watch lists, unless you just came in from libya don't be scared of your own shadow because it makes everyone crazy
people NEED chemicals or you will be fucking hammered by service charges to 'professionals' at EVERY step. Even good drain cleaner or muratic acid. 

Yea I need some entitled certified professional to help me do this 'super dangerous' plating process on a piece of steel. 

[Halcyon]

Would you mind sharing a picture or two and the full prerequisit?
This changed from guessing you want to obtain a chip layout to 'me needs to access data'.
Maybe there is a way you did not think of, but we are somewhat left to pokeing at it with a stick without a chance to understand the actual task.

Photos attached for anyone who is interested.

Nothing has really changed, it's always been about accessing the data. That I can do easily, getting access to the NAND is the difficult part in this case.

I've pretty much decided that this is a dead end. It's not really going to be worth the time or effort for the data that is on it. Even if I managed to get access to the chip, there is no guarantee that its even intact or the data is readable.

I think the owner of this drive has learned a valuable lesson.

[magic]

Web search brings up some production/debug tools for this controller and datasheets of similar parts so I think data recovery professionals may be able to help if the owner cares enough to fork out some $$$. Flash recovery seems to be a thing, I have seen ads.
Or you can try to DIY.
I don't understand your logic in decapping this damn thing. Everything needed to talk to it should already be brought out to that SOIC.