PC-3000 Flash. How to Recover Data from the NAND Flash Drives with the COB (Chip on Board) Memory Chips

Hello friends!

The COB (Chip On Board) memory chips present a challenge to data recovery engineers trying to recover data from them. The main obstacles lie in their internal structure: under the coating of black plastic, there is just a NAND crystal with small traces connected to the PCB. The procedure of coating removal is very dangerous since you can easily damage the NAND core. And even if you succeed, it doesn’t mean that you can read data from such a chip.

So what can you do if a NAND Flash drive with the eMMC chip that has a disabled controller, the COB controller, or even the COB memory chip ends up on your desk? In this article, we will show you the unique way to handle these untypical but commonly encountered cases.

Let’s explore the process of data recovery on the example of a Phison PS2251-67-5-based USB drive with the COB NAND chip that we have in our lab:

The first thing you should know – the chip-off is not an option here. And that’s where the ACE Lab Spider Board Adapter comes in. This adapter works perfectly with the monolithic devices including such untypical Flash Storage Devices as the drives with COB memory chips.

Before we start, let’s see which contacts and lines we need to read the NAND image. According to the ONFI.org specification, there are 16 of them:

1. 1. Bus line – 8 contacts for 8-bit chips:

• I/O 0
• I/O 1
• I/O 2
• I/O 3
• I/O 4
• I/O 5
• I/O 6
• I/O 7

2. Command pins – 6 contacts:

• ALE
• CLE
• RE
• WE
• CE
• R/B

3. Power Supply and Ground – 2 pins:

• VCC
• GND

All these pins must be connected to the NAND chip before the reading procedure becomes possible.

We already know that we cannot get data from the COB chip due to the compound cover of black plastic. But! All modern NAND controllers are also based on the ONFI specification, so we can try reading data via the CPU!

Our first step is to find the Phison PS2251-67-5 controller’s datasheet on the Internet:

What do we see here? The Pins names are a little bit different, but we still can find the target pins here:

Bus Lines:

• 5 – I/O 0
• 11 – I/O 1
• 13 – I/O 2
• 15 – I/O 3
• 21 – I/O 4
• 23 – I/O 5
• 25 – I/O 6
• 27 – I/O 7

Command Lines:

• 6 – CLE
• 7 – ALE
• 8 – WE
• 10 – RE
• 17 – CE
• 18 – R/B

Power Supply and GND:

• 35 – VCC
• 41 – GND

After that, we need to remove all the capacitors, transistors, and resistors from the PCB. Usually, they protect the board, the controller, and the NAND from the USB power supply. But, in terms of data recovery, they can create additional hurdles. That is why we strongly recommend you to get rid of all of them.

The next step is to arrange the pins by putting the needles on the controller pads. In practice, it is no different than the same procedure with monoliths, and it commonly takes about 7 minutes.

Then solder the VCC and GND! You should be able to send the PWR and the GND through the wires because you need to have a good NAND core powering.

Let’s start to arrange the needles:

The arrangement is ready!

Now, we are ready to launch the PC-3000 Flash software to set the needles connections:

After all these steps are made, we need to check the pins – there shouldn’t be any short circuit between them!

And here we get the chip ID!

Now we can read the NAND, fix the ECC, and apply the XOR. After all the preparations, you can finally recover data from the NAND Flash drive with the COB (Chip on Board) Memory Chip:

You can use the same approach when you recover data from the eMMC-based storage devices with the external controller.

It’s not a common eMMC chip with the NAND and the CPU inside – it’s a damaged, sorted eMMC with a disabled internal controller. The manufacturer used this eMMC as an external NAND chip coupled with the PS2251-67-5 controller. That’s why it will be useless to read this eMMC chip through the eMMC interface. But you can extract data from such a device using the method described in this article.

If you have any questions regarding your data recovery cases, you’re welcome to address them to the Technical Support department.