A car stereo that will not power up can still hold the journey. Call logs, paired phones, navigation history and messages often sit in a flash chip on the head unit or in a telematics module, not on a memory card you can unplug. When the unit will not boot, or the case is too damaged for a normal acquisition, examiners remove that chip and read it on the bench. That is chip-off.
This note is for vehicle examiners who need the hardware side of a physical read. FoneFunShop is an independent UK supplier and is not affiliated with any vehicle forensic software publisher.
What "chip-off" means on an IVI board
Infotainment and telematics boards keep user data in soldered memory. The package changes with the car and the year:
- NAND in a TSOP. Older head units often use a 48-pin TSOP NAND. Published teardowns have shown Samsung NAND in Ford SYNC generation 1 modules and Toshiba NAND in a Chrysler Uconnect Touch 8.4 head unit.
- Parallel NOR in a wider TSOP. A 56-pin TSOP NOR, such as the Spansion part fitted to some GM OnStar modules, is a different socket from TSOP48. The pin count is the clue.
- Serial flash in SOIC. Small 8-pin and wide 16-pin SPI chips often hold boot or recovery code. The Mazda Connect head unit is a documented example of a 16-pin Macronix serial flash.
- eMMC in a BGA. Newer units store the bulk of the user data in an eMMC. Ball count and body size both matter. A 169-ball part around 12 x 16 mm is not the same socket as a 153-ball part around 11.5 x 13 mm, even though both are eMMC.
Chip-off is the route for a board that is burnt, soaked, crushed, or simply dead. It is also the route when you need a raw image and the head unit will not talk. It is a destructive step. The chip has to come off the board, and a bad lift can destroy the evidence. If the unit still powers and your method can acquire it in place, that is usually the better first choice.
Where the UP-828P fits
The UP-828P is a universal programmer. It does not connect to the car. It reads the memory after you have removed it and seated it in a matching UP-828P adapter. The result is a raw binary file you can hash, archive and hand to analysis software.
On vehicle work it is used for three jobs:
- Reading NAND and NOR in TSOP and BGA packages from head units, navigation boards and telematics modules.
- Reading SPI flash in SOIC packages, which is often the boot path rather than the main user store.
- Reading eMMC, including the boot partitions and registers as well as the user area, which is where a lot of IVI data actually lives.
The programmer does not decode the image. It does not know that a file is a call log or a track. Decoding is the job of the vehicle forensic software you already use. Most vehicle forensic analysis tools can import a raw image taken with a chip reader. We do not sell analysis software, and buying a UP-828P does not include any.
The UP-828P uses its own adapters. Sockets made for the older UP-828 will not fit. If a name does not end in "P", do not assume it belongs on this programmer.
Pick the socket from the chip, not from the badge on the dash
Two cars from the same brand can use different memory. Before any heat goes near the board:
- Photograph the board and the chip marking.
- Identify the package: pin or ball count, and the body size in millimetres.
- Check that the exact part is in the UP-828P device list. A socket that is the right shape is not proof the software supports the ID.
- Only then remove the chip, reball or clean the contacts, and read it.
The programmer checks for shorts and poor pin contact during the read, which catches a chip that is not sitting flat. It will not repair a chip that was cracked during removal.
Examples we have been able to tie to a package, so you can see why the socket list looks the way it does:
- TSOP48 NAND: Samsung K9F2G08U0A in Ford SYNC generation 1, Toshiba TC58NVG5D2 in a Uconnect Touch 8.4, Micron MT29F8G08ABACA in a Continental head unit.
- TSOP56 NOR: Spansion S29GL512P in a GM OnStar generation 9 module.
- SOIC16 wide: Macronix MX25L6445E in a Mazda Connect CMU.
- 169-ball eMMC, 12 x 16 mm: SanDisk iNAND in a Uconnect Touch 8.4.
- 153-ball eMMC, 11.5 x 13 mm: Micron and Samsung parts in Hyundai and Kia head units, and SK hynix eMMC in Tesla Model S and Model X MCU1 units.
Those are examples, not a coverage promise. A later revision of the same head unit can change the chip. Read the marking on the one in front of you.
The set we sell for this work
The pieces live together on the vehicle forensics UP-828 collection:
- The UP-828P programmer itself. Power supply, USB cable and manual are in the box. Adapters are not.
- TSOP48P, TSOP56, SOIC8P, SOIC16WP, EBGA64P, FBGA137P and VBGA162NP for the packages most often named for vehicle boards.
- VBGA169P and VBGA153P for the two eMMC body sizes above, plus VBGA221P for 221-ball parts.
BGA63 NAND and BGA100 eMMC (14 x 18 mm) are the two vehicle packages we are adding and do not list yet. If a case needs one of those, ask before you lift the chip. We would rather you wait for the right socket than read a chip in the wrong one.
Phone and tablet sockets for the same programmer are sold separately. Do not fill a vehicle kit with BlackBerry or handset-only adapters unless you also do mobile chip-off.
What you get out of the read
A finished read is a binary file and a hash. What an examiner can then show depends on the file system and on the software licence, not on the programmer. On many head units that is enough to reach paired-phone records, contacts, messages, navigation history and stored media, including material the unit no longer displays because it will not boot. Deleted data is a question for the analysis tool and the file system, not something the programmer recovers by itself.
Keep the hash with the image. If the read is later challenged, you want to show the file is the same one that came off the chip.
Practical points before you order
- Lawful examinations only. You need the legal authority to examine the vehicle and to remove components.
- Budget for the sockets you will actually use. A programmer with no adapter does not read a chip.
- Lead time is typically about 7 days when an adapter is not on the shelf.
- Software for the programmer is arranged with the order. There is no public download on this page.
- Train the removal on scrap boards first. The expensive mistake is a lifted pad or a cracked BGA, not a slow read.
Shop the vehicle forensics UP-828 collection, or go straight to the UP-828P universal programmer.
UP-828P vehicle forensics: the short answers
What is the UP-828P used for in vehicle forensics?
The UP-828P reads the memory chip from a car stereo, head unit, sat-nav or telematics module once that chip has been taken off the board. It is used when the unit is crash, fire or water damaged, will not power up, or cannot be acquired in place. The result is a raw binary image of the whole chip that you hash, archive and load into your vehicle forensic analysis software. The programmer reads the chip. It does not decode the data and it does not connect to the car.
How does chip-off on an infotainment or telematics unit work?
- Photograph the board and read the marking on the memory chip.
- Identify the package (TSOP, SOIC or BGA), the pin or ball count and the body size, then check the part is supported by the UP-828P software.
- Remove the chip with hot air or IR rework, then clean or reball it so every pin or ball makes contact.
- Seat it in the matching UP-828P adapter. The programmer checks for shorts and poor contact before it reads.
- Read the full chip, including eMMC boot partitions where the part has them, and record a hash of the image.
- Import the image into the analysis software your lab is licensed to use.
Which chip types and packages do our UP-828P adapters cover?
- NAND in 48-pin TSOP: TSOP48P
- Parallel NOR in 56-pin TSOP: TSOP56
- Serial (SPI) flash in SOIC: SOIC8P and SOIC16WP (wide body)
- BGA flash and NOR: EBGA64P (64-ball, 1.0 mm pitch), FBGA137P (137-ball), VBGA162NP (162-ball)
- eMMC and iNAND: VBGA169P (169-ball, 12 x 16 mm) and VBGA153P (153-ball, 11.5 x 13 mm)
- eMCP: VBGA221P (221-ball)
The programmer reads NOR, NAND, serial flash, eMMC, eMCP, iNAND and moviNAND. The full socket range, including phone and tablet sockets, is in UP-828P Adapters. Pick the socket from the chip marking and body size, not from the make of car.
What data can be recovered from a head unit?
That depends on the unit, the file system and your analysis software, not the programmer. Data often found on infotainment and telematics memory can include the vehicle VIN, paired and connected phones, call logs, contacts, text messages, navigation history and saved destinations, and stored media. None of it is guaranteed on a given unit, and some of it may be encrypted or missing.
What is in the UP-828P Vehicle Forensics Kit?
The UP-828P Vehicle Forensics Kit contains the UP-828P programmer with power supply, USB cable and manual, plus ten UP-828P adapters: TSOP48P, TSOP56, SOIC8P, SOIC16WP, EBGA64P, FBGA137P, VBGA162NP, VBGA169P, VBGA153P and VBGA221P. Chip removal and rework equipment is not included.