Reading NAND Flash Chips Without Removing Them

Here’s an interesting method of reading data off of a NAND flash chip. Often we see these chips desoldered in order to read and write data, but not this time. This method uses hacked adapters to match the pin pitch of the various chips. Above you see parts of a breakout board cut down to use as wedges. These are drag soldered to the pins of the chip, then the appropriate breakout pins were connected to a Smartmedia card reader, which can read NAND chips. There is also an example showing the flexible connector cable for a DVD rom used as the adapter to solder to a smaller chip. We still looks pretty tricky, but it might be less labor intensive than relocating the flash chip like we saw on that Sega Game Gear hack, as long as you only need to read or write the data once.

[Thanks Laurdy]

25 thoughts on “Reading NAND Flash Chips Without Removing Them

  1. cool!
    now can someone use this to kludge together a wifi xd card please?
    in theory it is possible but i have never seen one.

    also could be worthwhile making a pcb which has an xd port on one end and an array of flash pads on the other with a digital switch chip so multiple chips can be soldered to it and switched between the single xd port.

  2. i have tried methods like this before with reading them with out removing them (in one of my own circuits) and i have had problems with 3 major things
    1) powering the memory powered the MCU and caused reading conflict … i tried fixing with a diode but than
    2) i blew an enable transistor … i dont know why
    than i fixed that than
    3) i kept on getting corruption in the extracted data

    i find that programming in some debug lines for pulling flash off inside of the microcontroller to be the easiest method but its slow and would only help if you made the circuit your self

    1. Like DarkFader said, keep the MCU in reset, most micros power up with their pins safe (high Z).

      If you can’t force it to stay in reset (e.g. it has internal power-on circuit), choke it’s main clock source (unless it too is internal, a RC). When you do so, the MCU will come out of reset but it won’t execute on-chip hardware configuration routine and pins will remain passive

  3. I would think a clamp-on adapter would be better than one you have to solder onto the chip. Wouldn’t you run the risk of desoldering the chip from its board when it comes time to remove the adapter?

  4. I know from experience that different brands of NOR chips have different init, reading and writing protocols, even if they are of the same spec and pin-compatible.
    I hope this is not the case for NAND.

  5. If you’re going to solder to the chip anyhow why not just remove it, read it, solder it back on.
    It seems to me this would be a method that you would guess would be faster but would eventually turn out to take ages and get extremely annoying.

  6. If I’m not mistaken, the board in the picture is from a cvs disposable video camera. I used to belong to a hacking community for them and this method was used to read the NAND chips since we didn’t have an unlock yet for the newer cameras. Oh the good old days

  7. @BiOzZ what about combining the two approaches, use some of those fine pitch elastomers from the pound world “live test” screwdrivers, and two pcb segments from a surplus lcd panel for the fine pitch leads.
    ought to work…
    also shouldn’t damage the chip as these are resistive.

  8. Now that’s what I call dedicated.

    I once desoldered the 4x 1GB SSD chips from an Asus Eee 701 and soldered them into an Eee 900 whose SSD died, the transplant didn’t work so I transplanted them back into the original Eee 701 and they continued to work in that without problem.

  9. @zeropointmodule

    i think your on to something there

    if the resistance is not to much and you get your alignment just right i don’t see how that method would not work

    i take it you mean with the rubber conductive spacer/cable thing that attaches the lcd to the board?

  10. @BiOzZ Yeah, I tried using one as an OLED contact but unfortunately it didn’t work as well as I’d hoped due to the contacts being too fine a pitch.

    Would work well for this application though.
    Also these are relatively cheap and readily obtainable.

  11. This is an intersing solution. I once had the same problem, read a NAND flash chip in circuit. I used JTAG Boundary Scan to bit bangle the pins of the CPU and create proper NAND read sequences. It was awfully slow and took 2 days to write the code, but it worked. ;)

  12. So, I need some help.
    After reading all your comments I figured you guys would have a solution.

    I have a ZTE ZMax Pro(Z981). The resistors on the board a fried, for the battery.

    I have some important pictures and possibly videos in the internal memory. I do know that repair shops are able to transfer data, but I assume the phone has to be turned on. How, and what, can I do to retrieve it?

    For the record, I am a noob at this. I have been replacing parts on my personal things and never had any issues, such as digitizers and LCD’s. However, the one time I repair someone elses I managed to pop the resistors. So yeah, definately a noob.

  13. My phone is totally dead. Not able to charge it. Went to Asus Service Center, but the denied for any help, as the motherboard s dead as well. However, I have some important data in internal memory of the phone. So please let me know if there s any way to get that data

  14. My phone, an LGV10, is dead. It tries to come on once in awhile but the battery doesn’t have enough charge. I tried a new battery, but it still will not charge. Can you help me?

  15. Perhaps one May 3D print a snap on (ice cube) style capacity integrated paths to insert wire through that loops back up at the end to provide a sound connection. This kind of thing interests me and more so the challenge of making it work than the actual read/write. I do enjoy fabricating useful tools that I never use again, lol.

Leave a Reply to salecCancel reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.