3/10/2019 EMMC Data Recovery From A Bricked Phone | Hackaday

EMMC DATA RECOVERY FROM A BRICKED PHONE

by: Jenny List 12 Comments

October 26, 2018

We’ve probably all got at least one old cell phone lurking somewhere around our bench. In most cases they’ll still work, but their
batteries may be exhausted and their OS could be an ancient version. But sometimes there will be a phone that just died. One
minute the flagship model, the next a useless slab of plastic and glass with the added annoyance of those priceless photos of
Aunty May’s 80th forever locked in its memory.

[Andras Kabai] had just such a device land on his desk, a high-end Sony whose screen had gone blank. Others had tried, he was
the last hope for the data it contained. He zoomed in on the eMMC chip on its motherboard, desoldered it and hooked it up via a
specialist eMMC reader to recover those files. That was a very simple description of a far more involved process that he sets out
in his post about it, a post that is fascinating reading and serves as a handy primer for any reader who might like to try it for
themselves. We learn about the MMC interface and how simple it can be in its serial form, how with some fine soldering you can
use a cheap USB reader, and that eMMC chips have a pinout conforming to a JEDEC standard.

Finally we see the software side as he takes the various SQLite databases and extracts the data for the user. It shows, all is not
necessarily lost, however dead a phone may be.

We’ve seen [Andras] before, using an old scanner in his PCB fab.

Posted in Cellphone Hacks

Tagged cell phone, data retrieval, emmc

← DIY TUNING CAPACITORS FROM WASHERS AND 3D-PRINTED PARTS

CHILD’S PUSHCAR GETS SERIOUS HORSEPOWER →

https://hackaday.com/2018/10/26/emmc-data-recovery-from-a-bricked-phone/ 1/4
3/10/2019 EMMC Data Recovery From A Bricked Phone | Hackaday

12 THOUGHTS ON “EMMC DATA RECOVERY FROM A

BRICKED PHONE”
paul says:
October 26, 2018 at 2:12 am

I like the Idea of the Odroid’s from Hardkernel.

These are small Linux computers ( Just like Beaglebone, Cubieboard, Orange pi and many others) and they have a nice feature where they put the
EMMC module on a separate pcb with a connector to the main board.
They can be easily replaced if damaged / worn out or if you want to experiment with different linux distributions.

They also have an adapter print, whith which you can use their eMMC modules just like any regular uSD card.

Reply Report comment

Sjaak says:
October 26, 2018 at 2:51 am

What are the options if the flash has been encrypted? Is there a way to retrieve the keys (before the Phone is broken) and use them during recovery?

Reply Report comment

darronb says:
October 26, 2018 at 6:00 am

This is my issue (minus the “before the Phone is broken” part). I have an old phone PCB lying around with about 6 months of photos and videos
in case I ever figure that out. Encrypted flash android phone.

Reply Report comment

Francis Theodore Catte says:

October 26, 2018 at 7:19 am

If you can get the flash dumped, there’s cli Linux tools to open the crypt container and mount the data partition into a loop filesystem. I
managed to recover stuff off of my wife’s bricked LG G2 (classic LG bootloop) by sticking it in the freezer to stop the bootloops long
enough to dump the flash, then unencrypted the data partition and mounted it on my laptop.

Reply Report comment

GrahamM says:
October 26, 2018 at 10:22 am

Depends on the manufacturer and how they handled the encryption keys. I’m aware that some manufacturers (esp Qualcomm based) utilise
hardware keys to try to bind the keys to the hardware via TrustZone. There’s a fair bit of detail on http://bits-
please.blogspot.com/2016/06/extracting-qualcomms-keymaster-keys.html that might help you there.
I’m also aware of some QC manufacturers that utilise a different way of protecting the key encryption key (KEK), but still utilising the SHK to try
to bind to hardware. It’s a little complex!

Reply Report comment

https://hackaday.com/2018/10/26/emmc-data-recovery-from-a-bricked-phone/ 2/4
3/10/2019 EMMC Data Recovery From A Bricked Phone | Hackaday

DedR4M says:
October 26, 2018 at 3:12 am

This great show of data recovery reminded me of someone who knew similar to build their own memory card:
https://ripitapart.com/2016/10/28/emmc-adventures-episode-1-building-my-own-64gb-memory-card-with-a-6-emmc-chip/

Great show of success with the data recovery

Since [Andras Kabai] used an adapter and I’m currently still using enamel wire, I wonder how much the adapters or kits cost?
I’m gonna search around for one soon, looks too handy.

Luckily the eMMC wasn’t encrypted.

Reply Report comment

ginbot86 says:
October 26, 2018 at 12:53 pm

Oh hey, that’s my blog! ^^

Back in late 2016 I purchased an eMMC test socket for $184 USD total (including shipping to Canada); it breaks out the eMMC into an MMCplus-
shaped PCB so you can stick it into any device that accepts full-size SD/MMC cards. The price has since gone down significantly, only $105
USD now: https://www.ebay.com/itm/eMMC153-169-Reader-test-socket-SD-BGA153-169-IC-Size-11-5x13mm-Data-
Recovery/152151938830 (Note that there are different sizes of eMMC packages, but 11.5x13mm is the most common now.)

I’ve already used it to recover data from my Galaxy S II. The nice thing about these sockets is that it will work with or without solder balls (so
reballing is not necessary to read/write to the eMMC).

Reply Report comment

mogwopjr says:
October 26, 2018 at 5:57 am

If only UFS were so easy.

Reply Report comment

Arsenio Dev (@Ascii211) says:

October 27, 2018 at 7:31 am

I’ve got an old bootloop bricked G4 that has a bunch of photos and stuff on it, I should try this method to yonk the data off. I’ll buy a bunch of dead
mainboards to practice on though

Reply Report comment

ginbot86 says:
October 27, 2018 at 7:51 pm

I think the G3 had a similar issue in which putting (maybe keeping) the device in the freezer let the device work just long enough to recover
information from it. My guess is that there are cracked BGA joints that might even be reflowable.

Reply Report comment

SkinnyV says:
October 29, 2018 at 9:28 am

I don’t want to be the negative guy, but what is the challenge/hack here if you are using a 150$ E-Mate Pro eMMC Tool MoorC v3 that was basically
made for that exact purpose beside de-soldering the chip from the phone?

Reply Report comment

Farwah Hassan says:

January 13, 2019 at 4:17 am

My phone was locked with a pattern and usb debugging off. I had to replace the display to get my data. And it wasn’t that difficult.

https://hackaday.com/2018/10/26/emmc-data-recovery-from-a-bricked-phone/ 3/4
3/10/2019 EMMC Data Recovery From A Bricked Phone | Hackaday

Reply Report comment

https://hackaday.com/2018/10/26/emmc-data-recovery-from-a-bricked-phone/ 4/4