Ask HN: How to read data directly from a flash chip?
I'm an electronics novice (more of a software guy really) but need to dump the flash off an embedded device. It's surface mounted, and the device itself is bricked.
What is a good method to go about this? Are there any flash-dumping-as-a-service companies anywhere? If I need to do this myself, what pitfalls can I expect and what equipment do I need?
The chip is a EN29LV640B btw.
6 comments
[ 4.4 ms ] story [ 29.8 ms ] threadTell him Mike Crawford sent you.
- If you can do something with the part still in-circuit (i.e. the PCB assembly itself is still functioning), that's probably a preferable way to proceed. For instance, if the part is connected on the PCB to a processor, you may be able to connect to the processor via its JTAG or debug interface and dump the attached memory that way.
- If you're going to try to go down the flash programmer route, note that this will require you to get the part off the board, which can be tricky if you don't have the right equipment (especially if it's a BGA).
- One thought that comes to mind re: flash programmers is that some of the components distributors will do pre-programming as a service, which means they have equipment to program the loose parts (& may be able to use the same equipment to read the contents back out). If you or your company have a relationship with one of these sorts of companies, you might be able to lean on your sales rep to get a favor.
Comes in two packages a TSOP and a BGA. I'm hoping you have the TSOP. If you've got a TSOP, you can get a socket for it / probe it. You can probably also get a socket for the BGA but you might be paying out the nose.
I like the JTAG approach as well. Assuming it's connected to a processor or FPGA that's got boundary scan, even if the rest of the system isn't cooperative you can bitbang the contents of the flash out using the JTAG hardware.
The JTAG silicon - even if it's on the same die as the processor / FPGA is totally separate. It's something like a tiny state machine. Read up on it, really powerful. <https://en.wikipedia.org/wiki/Boundary_scan>
Another option is to transplant the interesting flash from the dead device to an identical working device. Use the working device to read out the contents of the memory. This will require some soldering skills.
Or.. you can pull it off the board, and get a programmer. The industry std is Xeltek but they're $$$$. I've got a TL866, works pretty well. <http://www.eevblog.com/forum/blog/eevblog-411-minipro-tl866-...
Or.. you can read the datasheet and build yourself something with an arduino. You'll run out of pins though, so maybe a pro? or maybe port expanders.
Good luck!
The TL866 I suggested does support your part.
If you've got the flash in a TSOP - another trick for getting at the flash is to find a FPC cable that has the same pitch as your TSOP and solder it down on the board. FPCs with varying pitches are available at Digikey etc. That way you don't have to remove the flash from the board.
Either way, if you have never dealt with the hardware part it might take you a little bit but you can figure it out. I suggest you start with the processor data sheet and familiarizing yourself with JTAG. That is usually your saving grace, at least it has been mine a number of times. BTW, this can be done even on third party boards, you just have to figure out the processor and the pin outs to get the right access.
bisrig has good suggestions and he is absolutely right you might be able to find a PCB shop that has the ability to pull the flash data off for you. There are even smaller shops you can find that might be able to do it at a reasonable cost. Just a thought too, you might look specifically for data recovery companies, many generally focus on Hard Drives, but my bet is some pull data off flash too (never know at least worth a phone call or two).
However, fundamental question is, if your device is bricked, then why you are not asking how to un-brick it or recover it and why you want memory dump? I am asking this question because dumping the flash memory which is on PCB is daunting task for even seasoned hardware engineer. May be there is alternate way to fix your actual problem.
But again it all depends what you want to achieve.