eMMC Chip-off

Intro

I intend on doing a writeup for eMMC chip-off process for dumping data. Typically eMMC can be found on phones, laptops, embedded devices, usb sticks. They can contain, user data or firmware.

The eMMC I worked with was

For now, however, this post is just an inventory of the equipment I’ve used, and where I ordered them.

Tools

T862++ BGA SMD SMT IRDA Infrared Rework Machine IR Desoldering Rework Station US

I paid $136 on eBay

EMMC153/169 Test Socket USB Reader IC Size 11.5x13mm NAND Flash Test

I paid $101 on eBay

Desoldering Wire Braid Solder Remover

Note: IRDA rework station could be replaced with a simple heat gun.

Process

The idea is to concentrate the heat onto the eMMC chip, and lift it off as soon as you see smoke indicating that the solder from the BGA has begun melting.

Next you will need to remove all excess solder from under the chip, using wire braid.

Then you drop the chip into the usb flash test socket and plug it into your PC.

I personally found that it took multiple tries getting the chip’s BGA to correctly make contact with the socket’s pins. Just keep retrying.

Depending on how the data is stored on the chip, you really need some low level mechanism of reading the raw bytes. The chip might be formatted with a file system like FAT that can be easily mounted in any OS, but it could just as well be format with ext3. Ideally you want to do a readonly dd dump and perform some form a forensics. Something like Binwalk can help to recover or uncover any data.

References

BGA – https://en.wikipedia.org/wiki/Ball_grid_array

MMC – https://en.wikipedia.org/wiki/MultiMediaCard