iPhone XS Data recovery from NAND flash

[Spider1211]

Hey guys, I have an iPhone XS which came in as dead. The phone was not worked on before (I was the first to open it). After diagnosis (Splitting board, etc) it's confirmed to have a shorted PP2v63_NAND line.

Removed the NAND flash and short is gone on the board. Measuring directly on the NAND, there is about 2 to 15ohm to ground.

Is there anyway of backing up data externally in such cases (Client has some very important files and no back ups)?

[mon2]

Re: iPhone XS Data recovery from NAND flash

https://youtu.be/4RwGsbk1aos

Consult with Jessa at ipadrehab.

Search out her YouTube videos.

May be practical to send in the phone to her but first relay your findings.

[Spider1211]

Re: iPhone XS Data recovery from NAND flash

Watched a bunch of her videos in the past. I also contacted them, but its either send the phone or pay for forum. Since the customer is not ok paying for that, am not gonna bother.

The video assumes the motherboard is damaged but nand chip is still OK. In my case the motherboard is OK but the NAND chip itself has a shorted PP2v63_NAND internally.

Rephrasing my question: Is PP2v63_NAND required for an external nand clone?

[mon2]

Re: iPhone XS Data recovery from NAND flash

Hmm. Too much fame for her I suppose.

the NAND chip itself has a shorted PP2v63_NAND internally.

If the NAND is shorted, how can you be sure the contents are ok at this stage of the review ?

We briefly did some searches in the past on NAND flash readers and tools - REWA should have these and they should be able to supply some answers.

My concern is that the NAND flash is THE storage device yet the client is wanting their data to be extracted. Is it possible that some component on this power rail is shorted and not the NAND flash IC itself ?

What are the details of this short? You have measure the resistance to ground of this NAND power rail ?

Can you index the part # from the schematic and where you are observing the short ? Will check the schematic once at the office.

Also post the logic board # so we are referencing the same.

[Spider1211]

Re: iPhone XS Data recovery from NAND flash

If the NAND is shorted, how can you be sure the contents are ok at this stage of the review ?

It's called hope, lol But on a more serious note, I assume the power does not go directly to the internal array but through some other circuitry first.

My concern is that the NAND flash is THE storage device yet the client is wanting their data to be extracted. Is it possible that some component on this power rail is shorted and not the NAND flash IC itself ?

What are the details of this short? You have measure the resistance to ground of this NAND power rail ?

Correct, the NAND is the storage. My hope is that, using an external reader, maybe the 2v63 power rail is not needed (since there are also some other IO power rails).

No, it's the NAND itself that is shorted since after removing it from the board there is no longer a short when measured on the board itself. But when measured on the NAND chip (by itself), the short is there (measure wrt to ground in both case).

Short Values:
2 to 15ohms (wrt to ground). Weird thing is, when it's left to rest with no power for over 10hours, the resistance increases to 30-40ish ohm but as soon as power is applied, it drops back to 0.8 - 2 ohm then stabilizes to 2-15ohms after a few minutes.

Note:
NAND would also get warm when power is applied. All caps on the shorted line was examined an showed no signs of damage. Those which looked even slightly suspicious were removed. As a last resort, the NAND itself was removed to give a definite fault location.

NAND Flash is U2600 (per phoneboard viewer - iphoneXS Core board). PP2v63_NAND is the affected power rail.

[mon2]

Re: iPhone XS Data recovery from NAND flash

Review this article:

https://www.ipadrehab.com/article.cfm?ArticleNumber=33

The nand, even if good enough to read, is encrypted.

[Spider1211]

Re: iPhone XS Data recovery from NAND flash

Review this article:

https://www.ipadrehab.com/article.cfm?ArticleNumber=33

The nand, even if good enough to read, is encrypted.

Yes, its encrypted. Am not looking at reading/accessing the user data on a PC but more to clone the data from 1 nand to another known good nand then resolder the cloned nand back to the board. Data will be accessed through the phone itself.

[repair_schematics]

Re: iPhone XS Data recovery from NAND flash

Yes the NAND is crypted.

There doesnt exist any readers for those new Iphone NANDs.

Noone has reverseegineered the controller and protocol used.

The only readers that exist are those that can read out config area of NAND.
Userdata and firmware is not possible to copy with a desoldered NAND chip.

To be able to read this NAND you probably need to inject that voltage on correct part "inside" NAND and isolate the short.

After that solder repaired NAND back and extract the data you want with working phone.

I think this is only a good idea in theory.

[Spider1211]

Re: iPhone XS Data recovery from NAND flash

@repair schematics, thank you for your insight.

I was also considering scrapping up the top part to access the internals, but since I dont have any similar spare to practice on, i'ld rather avoid. I watched a video where this was successfully done on an iPhone wifi chip but cant find any info/pics of a decapped NAND.

Looks like this one will be going to trash.

[mon2]

Re: iPhone XS Data recovery from NAND flash

Contact REWA for advice before throwing in the towel. Slim chance here but still not zero.

[Spider1211]

Re: iPhone XS Data recovery from NAND flash

@mon2: I did try contacting them but no reply so far :/