

Ask HN: How to read data directly from a flash chip? - qquestion

I&#x27;m an electronics novice (more of a software guy really) but need to dump the flash off an embedded device. It&#x27;s surface mounted, and the device itself is bricked.<p>What is a good method to go about this? Are there any flash-dumping-as-a-service companies anywhere? If I need to do this myself, what pitfalls can I expect and what equipment do I need?<p>The chip is a EN29LV640B btw.
======
dynode
First thing to do is have a look at the datasheet
<[http://www.eonssi.com/upfile/p200892917341.pdf>](http://www.eonssi.com/upfile/p200892917341.pdf>).
I was hoping that it'd be SPI or I2C, but it's a big parallel flash, so
reading it is going to take some hardware.

Comes in two packages a TSOP and a BGA. I'm hoping you have the TSOP. If
you've got a TSOP, you can get a socket for it / probe it. You can probably
also get a socket for the BGA but you might be paying out the nose.

I like the JTAG approach as well. Assuming it's connected to a processor or
FPGA that's got boundary scan, even if the rest of the system isn't
cooperative you can bitbang the contents of the flash out using the JTAG
hardware.

The JTAG silicon - even if it's on the same die as the processor / FPGA is
totally separate. It's something like a tiny state machine. Read up on it,
really powerful.
<[https://en.wikipedia.org/wiki/Boundary_scan>](https://en.wikipedia.org/wiki/Boundary_scan>)

Another option is to transplant the interesting flash from the dead device to
an identical working device. Use the working device to read out the contents
of the memory. This will require some soldering skills.

Or.. you can pull it off the board, and get a programmer. The industry std is
Xeltek but they're $$$$. I've got a TL866, works pretty well.
<[http://www.eevblog.com/forum/blog/eevblog-411-minipro-
tl866-...](http://www.eevblog.com/forum/blog/eevblog-411-minipro-
tl866-universal-programmer-review/>)

Or.. you can read the datasheet and build yourself something with an arduino.
You'll run out of pins though, so maybe a pro? or maybe port expanders.

Good luck!

~~~
dynode
Some more info - openocd is a not bad open source JTAG server.
<[http://openocd.org/>](http://openocd.org/>)

The TL866 I suggested does support your part.

If you've got the flash in a TSOP - another trick for getting at the flash is
to find a FPC cable that has the same pitch as your TSOP and solder it down on
the board. FPCs with varying pitches are available at Digikey etc. That way
you don't have to remove the flash from the board.

------
davismwfl
It will all depend on the PCB assembly & design. If that is still somewhat
functional or even if you think it is bricked, you may still be able to
recover the flash through the processor. I have had to deal with a PCB Design
that utilizes the AtMega 1284p processor and if the clock flag(s) get set
wrong it is "bricked" but can be reset and functional again. Like you I am not
a hardware engineer but have written my share of firmware although it always
helps to have a hardware guy with some design/debug experience around.

Either way, if you have never dealt with the hardware part it might take you a
little bit but you can figure it out. I suggest you start with the processor
data sheet and familiarizing yourself with JTAG. That is usually your saving
grace, at least it has been mine a number of times. BTW, this can be done even
on third party boards, you just have to figure out the processor and the pin
outs to get the right access.

bisrig has good suggestions and he is absolutely right you might be able to
find a PCB shop that has the ability to pull the flash data off for you. There
are even smaller shops you can find that might be able to do it at a
reasonable cost. Just a thought too, you might look specifically for data
recovery companies, many generally focus on Hard Drives, but my bet is some
pull data off flash too (never know at least worth a phone call or two).

------
bisrig
A couple of general ideas to help you scope the solution space:

\- If you can do something with the part still in-circuit (i.e. the PCB
assembly itself is still functioning), that's probably a preferable way to
proceed. For instance, if the part is connected on the PCB to a processor, you
may be able to connect to the processor via its JTAG or debug interface and
dump the attached memory that way.

\- If you're going to try to go down the flash programmer route, note that
this will require you to get the part off the board, which can be tricky if
you don't have the right equipment (especially if it's a BGA).

\- One thought that comes to mind re: flash programmers is that some of the
components distributors will do pre-programming as a service, which means they
have equipment to program the loose parts (& may be able to use the same
equipment to read the contents back out). If you or your company have a
relationship with one of these sorts of companies, you might be able to lean
on your sales rep to get a favor.

------
eevolve
If you are looking to just dump your Flash then you should look for tools such
as
[http://www.ezoflash.com/ezoflash.htm](http://www.ezoflash.com/ezoflash.htm).
JTAG is good option but for that you need your controller to be able to
exercise JTAG sequence (above responses have good suggestions). [Google Search
Term: EN29LV640B Adaptor or Programmer].

However, fundamental question is, if your device is bricked, then why you are
not asking how to un-brick it or recover it and why you want memory dump? I am
asking this question because dumping the flash memory which is on PCB is
daunting task for even seasoned hardware engineer. May be there is alternate
way to fix your actual problem.

But again it all depends what you want to achieve.

