Chip-off is a technique based on chip extraction from a mobile device and reading data from it. This is the most difficult way of data extraction. But it must be used when all other methods failed. This method becomes more and more popular among mobile forensic examiners<\/a>, so we decided to discuss this technique in details.<\/p>\n\n\n\n There are a lot of tools for extraction chips from circuit boards; we\u2019ll describe only a few.<\/p>\n\n\n\n For chip unsoldering you will need an IR station. It\u2019s difficult to name the model, because lots of them have the same features.<\/p>\n\n\n\n Chips in mobile devices (eMMC) have interface similar to SD cards (but eMMC has 8 bit data bus, SD card \u2013 maximum 4 bit). All eMMC can work on 1 bit bus. But if we use this feature for data extraction, it will take too much time. So we need same equipment as for SD cards and also adapters for chips.<\/p>\n\n\n\n Figure 1. VISUAL NAND RECONTRUCTOR (Rusolut) and adapters [3]<\/em><\/strong><\/p>\n\n\n\n ACE Lab also has great knowledge base available for registered users. It\u2019s very useful.<\/p>\n\n\n\n Figure 2. Customizing analysis chain of an Android smartphone dump<\/em><\/strong><\/p>\n\n\n\n Figure 3. Oxygen Forensic Extractor (Oxygen Forensic Detective)<\/strong><\/em><\/p>\n\n\n Chip unsoldering is the most important part of chip-off process. The chip mustn\u2019t be overheated. It will delete all data. Usually it happens, because an examiner thinks that air isn\u2019t hot enough to melt soldering flux, and increases temperature too much. An examiner should remember, that chip is not only soldered to the board, but also glued with compound. That\u2019s why you should not only heat it, but also try to extract it carefully. We recommend using IR station. Even the simplest IR station with automatic temperature regulator allows unsoldering BGA chips with safety. For standard chips unsoldering temperature is ~225-230 \u00b0C, for chips glued with compound – ~240-245 \u00b0C.<\/p>\n\n\n\n To extract a chip from a smartphone board we recommend heating it to 240 \u00b0C and then use a blade to extract it.<\/p>\n\n\n Figure 4. Chip extraction from circuit board<\/em><\/strong><\/p>\n\n\n\n When you unsoldered the chip from the board, you should clean it from compound. The most effective way \u2013 to melt it with hot air and remove with solder wick. Make sure your work place is well ventilated \u2013 compound evolves aggressive smoke while being heated.<\/p>\n\n\n\n Figure 5. Heating compound with solderer<\/em><\/p>\n\n\n Figure 6. A chip with compound (left), cleaned chip (right)<\/em><\/strong><\/p>\n\n\n\n Here we describe a few cases where chip-off technique was used for data extraction from mobile devices. Such cases are typical for our lab.<\/p>\n\n\n <\/p>\n\n\n\n Figure 7. An eMMC chip with damaged controller on Rusolut adapter<\/em><\/strong><\/p>\n\n\n\n Usually chip-off technique is the only way to extract data from damaged mobile devices. This was HTC M8 smartphone. We extracted BGA chip from it and read the data with PC 3000 Flash. The dump we got was parsed with UFED Physical Analyzer.<\/p>\n\n\n <\/p>\n\n\n\n Figure 8. Smartphone fragments<\/em><\/strong><\/p>\n\n\n <\/p>\n\n\n <\/p>\n\n\n\n Figure 9. eMMC chip<\/em><\/strong><\/p>\n\n\n <\/p>\n\n\n\n Figure 10. Data extracted from the chip<\/em><\/p>\n\n\n\n In most cases chip-off technique is the last chance to extract data from water damaged mobile devices. In this case we had water damaged Nokia Lumia 800 (without visible traces, the contact with water was short).<\/p>\n\n\n <\/p>\n\n\n\n Figure 11. Phone’s circuit board<\/em><\/p>\n\n\n\n We unsoldered the chip and put it into special adapter to read the data.<\/p>\n\n\n <\/p>\n\n\n\n Figure 12. Chip unsoldering<\/em><\/p>\n\n\n <\/p>\n\n\n\n Figure 13. BGA 169 adapter<\/em><\/p>\n\n\n\n After we used simple card reader and USB write blocker to read the data.<\/p>\n\n\n <\/p>\n\n\n\n Figure 14. BGA 169 inserted into card reader<\/em><\/p>\n\n\n\n VISUAL NAND RECONTRUCTOR successfully read the dump with rare TexFAT file system.<\/p>\n\n\n <\/p>\n\n\n\n Figure 15. VISUAL NAND RECONSTRUCTOR – Main Window<\/em><\/p>\n\n\n\n Then we carved SMS messages from store.vol.<\/p>\n\n\n <\/p>\n\n\n\n Figure 16. Carved SMS messages<\/em><\/p>\n\n\n\n That\u2019s how we extracted all data needed for investigation. The technique can be used for data extraction from almost all water damaged mobile devices.<\/p>\n\n\n\n There are a lot of such cases in our lab. The main problem here \u2013 locked bootloaders, so you can\u2019t use the method described in our article Physical acquisition of a locked Android device [12]. Also, top mobile devices don\u2019t allow you to use JTAG technique, so chip-off is the only option.<\/p>\n\n\n <\/p>\n\n\n\n Figure 17. Passcode locked smartphone<\/em><\/p>\n\n\n <\/p>\n\n\n\n Figure 18. eMMC chip<\/em><\/p>\n\n\n <\/p>\n\n\n\n Figure 19. Data parsed with Oxygen Forensic\u00ae Detective<\/em><\/p>\n\n\n\n That time we examined Microsoft Nokia Lumia 830 (RM-983) running Windows Mobile 8. There is no solution of data recovery from this phone other than chip-off. And again we used an adapter (USB that time) to read the data and recover deleted files.<\/p>\n\n\n <\/p>\n\n\n\n Figure 20. Microsoft Nokia Lumia 830 (RM-983)<\/em><\/p>\n\n\n <\/p>\n\n\n\n Figure 21. Smartphone disassembly<\/em><\/p>\n\n\n <\/p>\n\n\n\n Figure 22. Phone’s circuit board<\/em><\/p>\n\n\n <\/p>\n\n\n\n Figure 23. eMMC chip<\/em><\/p>\n\n\n\n We used a USB adapter to read the data.<\/p>\n\n\n <\/p>\n\n\n\n Figure 24. USB adapter<\/em><\/p>\n\n\n <\/p>\n\n\n\n Figure 25. Partition structure<\/em><\/p>\n\n\n\n Also we use chip-off technique for data recovery from top Android devices. For example, recently we recovered data from HTC One smartphone running Android 6.0. It has locked bootloader, so there is no way to create physical image via ADB. Also we don\u2019t have equipment to extract data from it via JTAG.<\/p>\n\n\n\n Sometimes we need to extract data from very old mobile devices. Usually we can\u2019t even connect such devices to workstation, because they don\u2019t have interfaces. Also, usually there is no way to perform logical extraction either. So the only way to extract data (especially deleted) is using chip-off technique.<\/p>\n\n\n <\/p>\n\n\n\n Figure 26. JPG header in Sony Ericsson SE-T303 dump<\/em><\/p>\n\n\n\n Chip-off is the most difficult way of data extraction from mobile devices. This method forces examiner to work with encryption and encoding, unknown or hardly known file systems, new formats of databases. But, nevertheless, nowadays this technique is the most promising, because it can help to extract all the data both from working and damaged mobile devices.<\/p>\n\n\n\n <\/p>\n\n\n\n Igor Mikhaylov<\/a><\/p>\n\n\n\n Interests: Computer, Cell Phone & Chip-Off Forensics<\/p>\n\n\n\n<\/span>Hardware and software<\/span><\/h2>\n\n\n\n
<\/span>Chip unsoldering<\/span><\/h3>\n\n\n\n
<\/span>Data extraction equipment<\/span><\/h3>\n\n\n\n
<\/span>Hardware<\/span><\/h3>\n\n\n\n
\n
![\"1-chip-off\"](\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/08\/1-chip-off.jpg\")
\n
\n
<\/span>Software<\/span><\/h3>\n\n\n\n
\n
![\"2-chip-off\"](\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/08\/2-chip-off.png\")
\n
![\"3-chip-off\"](\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/08\/3-chip-off.png\")
\n
<\/span>Chip unsoldering: tips and tricks<\/span><\/h2>\n\n\n\n
![\"4-chip-off\"](\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/08\/4-chip-off.jpg\")
![\"5-chip-off\"](\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/08\/5-chip-off.jpg\")
![\"6-chip-off\"](\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2025\/12\/6-chip-off.jpg\")
<\/span>Practical Chip-off<\/span><\/h2>\n\n\n\n
![\"7-chip-off\"](\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2025\/12\/7-chip-off.jpg\")
<\/figure>\n<\/div>\n\n\n<\/span>Case #1. Data extraction from damaged mobile device.<\/span><\/h3>\n\n\n\n
![\"8-chip-off\"](\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2025\/12\/8-chip-off-scaled-1.jpg\")
<\/figure>\n<\/div>\n\n\n![\"9-1-chip-off\"](\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/08\/9-1-chip-off-300x292.jpg\")
<\/figure>\n<\/div>\n\n\n![\"9-2-chip-off\"](\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/08\/9-2-chip-off-300x277.jpg\")
<\/figure>\n<\/div>\n\n\n![\"10-chip-off\"](\"https:\/\/www.digitalforensics.com\/blog\/wp-content\/uploads\/2016\/08\/10-chip-off.png\")
<\/figure>\n<\/div>\n\n\n<\/span>Case #2. Data extraction from water damaged Nokia Lumia 800 with VISUAL NAND RECONTRUCTOR (Rusolut).<\/span><\/h3>\n\n\n\n
![\"11-chip-off\"](\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/08\/11-chip-off.jpg\")
<\/figure>\n<\/div>\n\n\n![\"12-chip-off\"](\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/08\/12-chip-off.jpg\")
<\/figure>\n<\/div>\n\n\n![\"13-chip-off\"](\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/08\/13-chip-off.jpg\")
<\/figure>\n<\/div>\n\n\n![\"14-chip-off\"](\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/08\/14-chip-off.jpg\")
<\/figure>\n<\/div>\n\n\n![\"15-chip-off\"](\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/08\/15-chip-off.png\")
<\/figure>\n<\/div>\n\n\n![\"16-chip-off\"](\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/08\/16-chip-off.jpg\")
<\/figure>\n<\/div>\n\n\n<\/span>Case #3. Data extraction from passcode protected mobile devices (or devices with damaged display)<\/span><\/h3>\n\n\n\n
![\"17-chip-off\"](\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/08\/17-chip-off.jpg\")
<\/figure>\n<\/div>\n\n\n![\"18-chip-off\"](\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/08\/18-chip-off.jpg\")
<\/figure>\n<\/div>\n\n\n![\"19-chip-off\"](\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/08\/19-chip-off.png\")
<\/figure>\n<\/div>\n\n\n<\/span>Case #4. Recovering data from mobile devices<\/span><\/h3>\n\n\n\n
![\"20-chip-off\"](\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/08\/20-chip-off.jpg\")
<\/figure>\n<\/div>\n\n\n![\"21-chip-off\"](\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/08\/21-chip-off.png\")
<\/figure>\n<\/div>\n\n\n![\"22-chip-off\"](\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/08\/22-chip-off.jpg\")
<\/figure>\n<\/div>\n\n\n![\"23-chip-off\"](\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/08\/23-chip-off.jpg\")
<\/figure>\n<\/div>\n\n\n![\"24-chip-off\"](\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/08\/24-chip-off.jpg\")
<\/figure>\n<\/div>\n\n\n![\"25-chip-off\"](\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/08\/25-chip-off.jpg\")
<\/figure>\n<\/div>\n\n\n<\/span>Case #5. Data extraction from old mobile devices<\/span><\/h3>\n\n\n\n
![\"26-chip-off\"](\"https:\/\/www.digitalforensicscorp.com\/blog\/wp-content\/uploads\/2016\/08\/26-chip-off.jpg\")
<\/figure>\n<\/div>\n\n\n<\/span>Discussion<\/span><\/h2>\n\n\n\n
<\/span>References<\/span><\/h2>\n\n\n\n
\n
\n
<\/span>About the authors:<\/span><\/h2>\n\n\n\n