Mobile Forensics - How to recover user data from Android UFS Chips

Mobile Forensics - How to recover user data from Android UFS Chips

Extracting Physical Data from UFS Chips Using UFi Box, EasyJTAG Plus, and ICFriend

When a device is physically damaged (e.g., water or fire damage), but the UFS chip is intact, chip-off methods allow data recovery that would otherwise be impossible.

Hardware & Tools Required

General Preparation

Desolder the UFS Chip

Carefully remove the UFS chip from the target device using a hot air station. Clean the chip’s BGA pads with isopropyl alcohol and solder wick.

Identify the Chip Type

Confirm the chip type (Samsung, Toshiba, etc.), model number, and BGA layout.

Using UFi Box

Insert the UFS Chip

Mount the chip into the correct ICFriend UFS adapter. Connect the adapter to the UFi Box and power it on.

Start UFi Software

Launch UFi eMMC/UFS ToolBox. In the UFS tab, click Identify to detect the chip and read its manufacturer details, capacity, and partitions.

Perform Physical Dump

Choose Read Full Dump or Read LUNs. Save the binary dump to disk and optionally extract specific partitions.

Image Carving

Use forensic tools like FTK Imager, Autopsy, or Scalpel to analyze the dump and extract images, media files, and databases.

Using EasyJTAG Plus

Insert the UFS Chip

Use the compatible ICFriend socket and connect it to the UFS extension board. Plug the extension into EasyJTAG.

Launch EasyJTAG UFS Tool

Start the software, select the appropriate chip, or use auto-detection. Click Scan or Identify UFS.

Data Extraction

Select Read by LUN or Full Chip Dump. Save images locally and optionally backup GP1–GP4, RPMB, and BOOT partitions.

Post-Processing & Image Recovery

Open the Dump

Use tools like Magnet AXIOM, FTK Imager, or Autopsy to open .bin or partition images. Carve data with foremost or bulk_extractor.

Validate Integrity

Check MD5 or SHA1 hashes to ensure the dump’s integrity.

Notes

  • Always use ESD protection when handling UFS chips.
  • Double-check BGA orientation before inserting into the socket to avoid damage.
  • UFi is optimized for Samsung UFS chips; EasyJTAG offers broader chip support and scripting options.

Let me know if you need pinout diagrams, chip ID help, or automated carving scripts.

Back to blog