Most phone extractions start with software. The device is powered up, plugged into a forensic tool, and the data comes out through its normal interfaces. Plenty of the phones that end up in a lab can't be handled like that, though. They won't power on, or they have been smashed, or there is simply no usable way in. When that happens the only place left to go is the memory chip itself, and that is what chip-off is for.
When software and board-level methods run out
Chip-off normally comes after the other options have been ruled out. The obvious case is a dead board that will not boot after liquid damage, fire, impact or a failed power circuit. Then there are boards where the processor or the parts around it are broken beyond any practical repair, but the storage chip may well have survived.
It is also the fallback when there are no JTAG test points to use and ISP will not give a reliable read. And it is not only phones. Car stereos, infotainment units, drones and plenty of other embedded devices keep their data on standard memory chips.
Before you reach for the hot air station, it is worth seeing whether the phone can be repaired enough to boot, or whether ISP will work. Both are less invasive. We cover that decision in ISP Before Chip-Off: Why You Try In-System Programming First, and the repair route is what our Forensic Repair Training is about.
What the job involves
Put simply, the chip comes off the board and gets read directly in a programmer. In practice there is a bit more to it.
First you identify it. Read the markings and confirm the memory type (eMMC, UFS or raw NAND) and the package, for example BGA153, BGA169, BGA221, BGA254 or TSOP48. Removal comes next. Controlled heat melts the solder balls and the chip is lifted off without cracking it, warping it or tearing pads, which is considerably harder on boards with underfill or epoxy.
Once it is off, the old solder and residue have to be cleaned away so the contacts are flat and clean, and the chip may need reballing. Then it goes into a socket or adapter that matches its package and is read with a suitable programmer or reader. The image that comes out is processed with forensic software to recover the file system and artefacts.
UP-828P Adapter VBGA221P (BGA221 socket)
eMMC, UFS and NAND
The memory type decides which hardware you need. eMMC puts the NAND flash and a controller in one package. You find it in older and cheaper phones and in a lot of embedded kit. UFS is the faster interface in most modern mid-range and flagship phones, and it needs a reader that supports UFS specifically. Raw NAND has no built-in controller. It turns up in older or simpler devices and can take extra work to piece the data back together. Confirm what you have before buying sockets or adapters.
The risks
Chip-off destroys the device as a working phone. Once the chip is off, it will not work the way it did before. The evidence is at risk too. Too much heat, or uneven heat, can damage the chip, pads can lift, and careless handling can contaminate it.
Encryption matters as well. On many modern phones the data on the chip is encrypted with keys tied to the phone's own hardware, so a raw read of the chip may not give you readable user data on its own. Know those limits before you choose chip-off, and document every step.
The kit
You need a programmer or reader to start with, and our Chip-Off Programmers and wider Chip-Off Tools collections are the place to look. Each chip package needs its own socket or adapter, so browse Sockets / Adapters and UP-828P Adapters for those.
For removal and prep you need a hot air station, a preheater, flux and cleaning tools. A good microscope is essential for removal, checking the pads and recording the chip's condition, and our Inspection & Magnification range covers that. Finally, build up skill on boards that are not evidence before you touch one that is. Our Forensic Repair Training covers hot air, soldering and board prep at the bench.
RF4 Trinocular Microscope with 4K Camera
Where that leaves you
When a device is too damaged to boot and the less invasive methods have failed, chip-off can still recover data that would otherwise be lost. It takes the right adapters, rework tools and magnification, and a lot of care. For the wider picture, read our guide Mobile Forensics Hardware: From Seizure to Extraction.