Chip reader for NAND Flash RAM?

[JordanBklyn]

Hi everyone... I'm trying to do some data recovery on my tablet. It's an Android Nexus 7 which has something like Hynix H26M64002DQR as its NAND Flash RAM. If I pay a data recovery company, it would cost quite a bit. So I'm thinking of doing the recovery myself as a hobbyist.

If I desolder the memory chip I should be able to get the data from it, but how will I read the chip? One data recovery company I spoke with described this "chip-off" recovery as a process they offer. I've tried googling for chip readers but could only find large and very expensive readers which are made for reading many types of chips. Is there a way I could either:

1. Wire up something myself ... Find a socket which will hold the NAND chip, design and build a simple reader board and connect it to my computer.

2. Or, buy an inexpensive chip reader (if it exists?) and pull the data off using it.

Any thoughts from the community? Thanks!
Jordan

[wraper]

Won't be nor cheap, nor easy. IMO you'll joust loose the data beyond possibility of recovery.

[lukier]

I was once curious about that (for other reasons, to read/write firmware from NAND chip). It seems not very straightforward.

There are some NAND programmers, for example on AliExpress, but quite expensive (compared to MiniPro TL866) and equally expensive BGA ZIF socket adapters. I would also doubt the quality of software provided with these programmers.

The second problem I suspect might be knowing how to descramble the data. Rarely the NAND chip does all the SLC/MLC magic (Flash Translation Layer, wear leveling etc), this is true on eMMC. Otherwise the CPU NAND controller might have some/all of this functionality and then finally it can be done purely in the software, for example by the MTD subsystem of the Linux kernel. For example, this is the reason why it took so long for Sunxi community to provide NAND support for Allwinner chips in the mainline kernel.

If you know exactly how the Flash Translation Layer is done on your Nexus you might have some chance, especially if it is handled purely by the Linux kernel. If the NAND controller in the SoC is smarter then I doubt you'll get the inner working details from nVidia/Qualcomm.

I don't know the inner workings of Nexus tablet, but maybe you can boot from USB, maybe with even the same kernel (config!) and then try to access the NAND device from there? (I'm assuming there is no encryption).

[JordanBklyn]

I've tried the USB route and unfortunately I hadn't set the correct options (USB debugging and/or rooting the device) prior to its downfall.  I've tried everything, sideloading, safe mode etc. and it's not going to work.

So unless I have a lot of money, I think I'm left with buying a socket and building my own little circuit to make the chip talk to the computer.  I am experienced in programming (C and assembly language), so I feel confident I can figure out how to write that layer.  The pieces I'm not sure about are the socket itself, and the circuit allowing the computer to communicate with the chip (probably via USB).  So far it sounds like the reader/programmer options out there are beyond my price range.

[rob77]

i don't know the nexus HW, but the tegra2 from nvidia had a nvflash tool - it was possible to read-out the whole flash from the device (you had to plug it into USB without battery while holding booth volume buttons and it went to a mode when it low-level exposed the whole flash through a USB device)
probably something like that exist for your nexus as well.

[mikeselectricstuff]

Reading NAND flash is pretty straightforward - they use a paralell command based interface that's not very complicated, especially for just reading. Take a look at the Micron datasheets which are pretty clear. Most NAND uses the same interface - the main differences between makes and types are page sizes, number of die etc.
 
However there are issues like bad-block mapping and ECC that significantly complicate the interpretation of the raw blocks  of data you read out. And of course the issue of dealing with the large amount of data involved.

[sd]

If that is the T30 Nexus 7, that e-nand is actually an eMMC.
You need to solder at least 5 fine wires (GND, VCC, CLK, CMD, DAT0) or 6 wires if it is a dual voltage part. DAT1-DAT7 can be ignored, it should work in 1 bit mode, fewer wires to solder.
All these wires can be connected to an SD card reader.

[JordanBklyn]

Wow "sd" that sounds promising.  As far as the "bad blocks" issue, it is a concern, but if I have the data, I can worry later about how to deal with that.  Having the data securely stashed in a file would be a relief, and allow me to figure it out somehow from that point, at my leisure.

So you're saying if I attach those wires from the chip itself (or a socket) to the SD reader, the computer will treat the chip like it would any SD card?  Is there any other missing step in there?  Sounds almost too easy, but I can hope  :-)

[mikeselectricstuff]

If that is the T30 Nexus 7, that e-nand is actually an eMMC.
You need to solder at least 5 fine wires (GND, VCC, CLK, CMD, DAT0) or 6 wires if it is a dual voltage part. DAT1-DAT7 can be ignored, it should work in 1 bit mode, fewer wires to solder.
All these wires can be connected to an SD card reader.

I'm assuming this is a similar thing to SD cards that can be read in SPI mode - Just because a card can be read in 1 bit mode, doesn't necessarily mean that an off-the-shelf reader will be able to use 1-bit mode

[sd]

@JordanBklyn
First you need to confirm what version of the Nexus 7 you have. There were two devices, one with a Tegra3 SOC (2012 model) and another one with Qualcomm SOC (2013 model). Most likely the 2013 model also has an eMMC, but I can't confirm that at the moment.

If it's a 2012 model, you don't need to worry about bad blocks or anything.
You can just connect the eMMC  to a PC via an USB SD card reader.

This is a board I made some time ago for the Kindle 3W:

It uses a 32GB eMMC and Microchip USB2240 - multi format flash media controller.
It can also be connected directly to a PC.

Under Linux:
"usb 3-1: new high-speed USB device number 52 using xhci_hcd
usb 3-1: New USB device found, idVendor=0424, idProduct=2240
usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 3-1: Product: Ultra Fast Media
usb 3-1: Manufacturer: Generic
usb 3-1: SerialNumber: 000000225001
usb-storage 3-1:1.0: USB Mass Storage device detected
scsi20 : usb-storage 3-1:1.0
scsi 20:0:0:0: Direct-Access Generic  Ultra HS-COMBO   1.98 PQ: 0 ANSI: 0
sd 20:0:0:0: Attached scsi generic sg3 type 0
sd 20:0:0:0: [sdd] 61997056 512-byte logical blocks: (31.7 GB/29.5 GiB)
sd 20:0:0:0: [sdd] Write Protect is off
sd 20:0:0:0: [sdd] Mode Sense: 23 00 00 00
sd 20:0:0:0: [sdd] No Caching mode page found
sd 20:0:0:0: [sdd] Assuming drive cache: write through"

Under Windows it's also mounted as a regular SD card.

It sounds easy because it is, you just need to power the eMMC properly. Usually they have two power rails, one for the controller/nand (VCC) and one for the I/Os (VCCQ).  If you are connecting this to a 3.3V controller, be sure that you connect VCCQ to 3.3V as well.
Also, use really thin wires if you solder to that BGA, those pads can come off really easily.

@mikeselectricstuff
I usually use eMMCs/eNANDs/eSDs with SOCs via SDIO/SDMMC interface, and they can work in x1/x4/x8 mode. Regarding off the shelf readers, I tried with two chipsets, from microchip, it worked in x1 or x4 properly. But yes, maybe there are card readers out there that can work only in x4 mode, in that case another 3 wires need to be soldered.

[@rt]

I'm using Microchip Memory disk Filesystem at the moment, and they make it sound just as easy to read NAND flash SPI as SD Card.

[JordanBklyn]

@sd  ... Mine is the 2013 model.  It seems this has Hynix H26M52003EQR chip:

Managed NAND Flash Serial e-MMC 3.3V 128G-bit 32G/16G x 4-bit/8-bit

Mine is 32gb.

[JordanBklyn]

It may also be a different Hynix model such as H26M64002DQR.  In any case it should be eMMC according to my web research  :-)

[JordanBklyn]

I'll open the tablet up again later and report back.  I believe it was Hynix last time I checked, but a thread I found elsewhere says it could be other brands:

"Nexus 7 2013 uses 3(?) brands of eMMC chips: Kingston, Hynix and Toshiba."

From http://forum.xda-developers.com/nexus-7-2013/nexus-7-2013-qa/fix-nexus-7-2013-bricked-stuck-t3310608

In any case they are all eMMC so according to @sd the 2013 should be possible to read using the SD reader method?!  Now I just need detailed specs for the chip pins, some equipment like fine wires, desoldering stuff, maybe a socket... Hmmm.

[JordanBklyn]

Wow @blueskull, 4 dollars?!  If this takes care of the whole process I'm trying to do, that's pretty incredible!  No designing, building, wiring, nada?  just have to wait for it to ship from Asia?  Desolder the chip and place it in the reader?  Amazing... and certainly worth a shot at that price!

Looking at your link, the only part I'm uncertain about is that "Hardkernel" red board that the chip is attached to.. If I desolder the chip, I guess I would have to resolder it to that board?

Managed NAND usually means eMMC, which is compatible with SD but WITHOUT SPI interface.
You can read it as SD card using this: http://www.hardkernel.com/main/products/prdt_info.php?g_code=G135415955758

[JordanBklyn]

For anyone who was following this thread previously... I have now opened the device and the Flash chip is as follows:

SKhynix H26M64003DQR e-NAND 321A M12J3739Q1

It had a sticker on the outside which said: 

51.1.15
YF2*A0
Hynix 32G

So now, the question is, can I actually manage to desolder this thing from the board without damaging the memory inside it?  I did some Youtube-ing and reading threads on message boards.  Seems that it's a tricky process.  Pros use an adjustable heat gun at a particular temperature and tweezers, moving the heat gun around to heat it evenly from the top... but it seems there's no guarantee that the chip or it's data won't be damaged by doing so... There are some DIY types using a griddle or hair dryer to heat the chip, either from underneath or on top.

If I can manage to desolder it without damage, and solder fine wires onto the correct pads on the BGA, and solder those to an SD card reader... maybe I can do this.  The remarks from "sd" about most readers downgrading to 1x (that means 1-bit, right?) seem encouraging.

(I had a crazy thought about leaving the NAND on the board, and instead scraping/sanding off the components which are on the opposite side of the board... then sanding my way through the PCB from the opposite side until I reach the BGA solder joints.  I imagine the BGA are connected to some traces on the top side, which would need to be cut in order to prevent complications.  It doesn't seem like the components on the opposite side (from the NAND) are connected to the NAND through the PCB -- they seem to be doing separate functions such as Wifi and Bluetooth.  Don't mind me, I'm a novice so these weird ideas come to me.)

Any further suggestions?

[mikeselectricstuff]

Desoldering shouldn't be a problem with hot air ( assuming no underfill).
The key thing is to let the hot air tool run for a minute or so to stabilise.
Practice on some scrap PCBs to get a feel for distance/burning issues, and drench it in flux.