Friday, 30 June 2017

The Wet Phone Affair
( or, How to Make Your Own SD Card)

One paddling pool plus one phone equals one project. After the phone was dried out it still didn't boot well enough to get stuff off it using USB. After all attempts to get the phone to boot had ended, there was one path left: take the flash memory off the phone and read it some other way. The phone was an 8G model and the flash was implemented using an 8G eMMC module. This is a common type of flash memory with a fairly standard pinout and form factor. The package used is a 153 ball BGA with pins on a 0.5mm pitch. Not all balls are connected, so it's definitely feasible to wire this device up and read the data off. Fortunately, as this is a eMMC device, it uses the MMC interface and so it is possible to wire the chip to look like a micro SD card.

So, I removed the chip from the phone PCB (hot air gun) and attached it to a micro SD to SD card adapter. Internally these are just wiring so there's ample metal inside to attach wires.

This is the internals after it's been wired up:

This device (Sandisk SDIN8DE2-8G)  has some things that I think are peculiar to itself. Some wiring hints:

D0 to D3 just wire to the appropriate SD card signals.
The CLK and CMD signals also wire directly.
The VCCI signal needs a capcitor to ground ( I used 200nF)
There's two VSS signals on this device and two VCCs. I wired both Vcc to the SD card Vcc and bot Vss to the SD card Vss.
I put a capacitor across Vcc and Vss. (1uF)

The wire I used was from an old transformer I dismantled, it has an insulating coating that needs to be scratched off to get a good contact. Thin wire is essential. A microscope is almost essential too, if just for inspection.

After wiring the SD card/eMMC arrangement, after a couple of false starts, it worked. The data was read with no errors in dmesg for a 7.3G dd invocation.

DIY SD card...


RebekahC said...

Thank you for saving my data!!! I had 4 months worth of photos, lots of notes (birthday presents lists, house to do jobs (Exciting right?!), and god knows what other stuff! And D managed to get off my texts which had a few important numbers I had forgotten about! Related to appointments and old friends of J's from nursery. I shall revisit my backing up plan!!! Thank you again! :-)

Lad Bla said...

Great job.
Can you please let me know where I can get pinouts( datasheet) for various eMMC sizes/model?

amen said...

It depends on the eMMC you are trying to get the datasheet for. I use google. Put the part number in to google and look for PDF links. Alternatively, you can look on the eMMC manufacturers website and do a search for the part number on there. You may not find it, some of these datasheets aren't available, they require an NDA, or something.
I was lucky with this eMMC, the datasheet was available.

Filippo said...
This comment has been removed by the author.
amen said...

I had a look around and if you search for 'Sandisk inand emmc datasheet' then you find the datasheet I had. It's called 'Industrial iNAND eMMC 4.51 1xnm HS200 Datasheet'.
That datasheet is more detailed than the short form document I think you found.