Difference between revisions of "Chip-Off BlackBerry Curve 9300"

From ForensicsWiki
Jump to: navigation, search
(Created page with "== Tear Down == # Remove the back panel. # Remove the SIM and SD Memory Card. # Using a torx-6 screw driver remove the 2 visible screws on the back of the phone. {| border="1...")
 
Line 10: Line 10:
 
|}
 
|}
  
 +
<ol start="4">
 +
    <li>Remove the screen protector using a plastic shim or guitar pick.</li>
 +
</ol>
  
#4 Remove the screen protector using a plastic shim or guitar pick.
 
 
{| border="1" cellpadding="2"
 
{| border="1" cellpadding="2"
 
|-
 
|-
[[File:2-PlasticScreen.jpg| 300px ]]
+
|[[File:2-PlasticScreen.jpg| 300px ]]
 
|-
 
|-
 
|}
 
|}
 
+
<ol start="5">
#5 Use the shim to detach the top-plate/cover from the device.
+
    <li>Use the shim to detach the top-plate/cover from the device.</li>
 +
</ol>
 
{| border="1" cellpadding="2"
 
{| border="1" cellpadding="2"
 
|-
 
|-
Line 24: Line 27:
 
|-
 
|-
 
|}
 
|}
 
+
<ol start="6">
#6 Remove 4 additional torx-6 screws.
+
    <li>Remove 4 additional torx-6 screws.</li>
 +
</ol>
 
{| border="1" cellpadding="2"
 
{| border="1" cellpadding="2"
 
|-
 
|-
Line 31: Line 35:
 
|-
 
|-
 
|}
 
|}
 
+
<ol start="7">
#7 Detach vendor plate and remove 2 more torx-6 screws.
+
    <li>Detach vendor plate and remove 2 more torx-6 screws.</li>
 +
</ol>
 
{| border="1" cellpadding="2"
 
{| border="1" cellpadding="2"
 
|-
 
|-
Line 38: Line 43:
 
|-
 
|-
 
|}
 
|}
 
+
<ol start="8">
#8 Separate back plate from the main board.
+
    <li>Separate back plate from the main board.</li>
 +
</ol>
 
{| border="1" cellpadding="2"
 
{| border="1" cellpadding="2"
 
|-
 
|-
Line 45: Line 51:
 
|-
 
|-
 
|}
 
|}
 
+
<ol start="9">
#9 The tear down is now complete
+
    <li>The tear down is now complete</li>
 +
</ol>
 
{| border="1" cellpadding="2"
 
{| border="1" cellpadding="2"
 
|-
 
|-
Line 62: Line 69:
 
|-
 
|-
 
|}
 
|}
 
+
<ol start="3">
#3 Place the main board in a stand or holder and position it under a heat gun or device the blows super hot air. We use a Wagner "model XYZ" positioned approximately 2 1/2" - 3" inches away from the main board.
+
    <li>Place the main board in a stand or holder and position it under a heat gun or device the blows super hot air. We use a Wagner "model XYZ" positioned approximately 2 1/2" - 3" inches away from the main board.</li>
 
+
</ol>
 
{| border="1" cellpadding="2"
 
{| border="1" cellpadding="2"
 
|-
 
|-
Line 70: Line 77:
 
|-
 
|-
 
|}
 
|}
 
+
<ol start="4">
#4 Monitoring the temperature the heat shield will come off easily between 190-200 Centigrade.
+
    <li>Monitoring the temperature the heat shield will come off easily between 190-200 Centigrade.</li>
 +
</ol>
  
 
{| border="1" cellpadding="2"
 
{| border="1" cellpadding="2"
Line 79: Line 87:
 
|-
 
|-
 
|}
 
|}
 
+
<ol start="5">
#5 Continue working under the high heat. In the 9300's I've worked on there is typically a black epoxy that has been applied to the NAND. Using a razor under the high heat this epoxy can be easily cut into. Once the epoxy has been cut and with the temperature around 215 Centigrade the NAND will be easily removed from the main board.
+
    <li>Continue working under the high heat. In the 9300's I've worked on there is typically a black epoxy that has been applied to the NAND. Using a razor under the high heat this epoxy can be easily cut into. Once the epoxy has been cut and with the temperature around 215 Centigrade the NAND will be easily removed from the main board.</li>
 +
</ol>
  
 
{| border="1" cellpadding="2"
 
{| border="1" cellpadding="2"
Line 87: Line 96:
 
|-
 
|-
 
|}
 
|}
 
+
<ol start="6">
#6 The BlackBerry Curve 9300 uses a stacked die 152 pin BGA, this includes a NAND stacked on a controller which is soldered to the main board. We are interested in the NAND and therefore must separate it from the controller. This is accomplished with the use of high heat (heat gun), a 20 x 20 x 0.5cm steel plate and a 10cm razor blade.
+
    <li>The BlackBerry Curve 9300 uses a stacked die 152 pin BGA, this includes a NAND stacked on a controller which is soldered to the main board. We are interested in the NAND and therefore must separate it from the controller. This is accomplished with the use of high heat (heat gun), a 20 x 20 x 0.5cm steel plate and a 10cm razor blade.</li>
 +
</ol>
  
 
* Position the steel plate under the heat gun. The plate will heat up and hold the heat, try not to burn yourself.
 
* Position the steel plate under the heat gun. The plate will heat up and hold the heat, try not to burn yourself.
Line 117: Line 127:
 
|}
 
|}
  
 
+
<ol start="7">
#7 Using liquid flux, or flux paste and a soldering iron scrape the remaining epoxy off the NAND and clean it up real nice to prep for a NAND read.
+
    <li>Using liquid flux, or flux paste and a soldering iron scrape the remaining epoxy off the NAND and clean it up real nice to prep for a NAND read.</li>
 +
</ol>
 
{| border="1" cellpadding="2"
 
{| border="1" cellpadding="2"
 
|-
 
|-

Revision as of 01:50, 8 August 2013

Tear Down

  1. Remove the back panel.
  2. Remove the SIM and SD Memory Card.
  3. Using a torx-6 screw driver remove the 2 visible screws on the back of the phone.
1-ScrewRemoval.jpg
  1. Remove the screen protector using a plastic shim or guitar pick.
2-PlasticScreen.jpg
  1. Use the shim to detach the top-plate/cover from the device.
3-TopPlate.jpg
  1. Remove 4 additional torx-6 screws.
4-ScrewRemoval.jpg
  1. Detach vendor plate and remove 2 more torx-6 screws.
5-ScrewRemoval.jpg
  1. Separate back plate from the main board.
6-SeperateBoard.jpg
  1. The tear down is now complete
7-TearDownComplete.jpg

NAND Removal

  1. Peel off the vendor sticker on the back side of the main circuit board
  2. The NAND is located beneath the heat shield directly above the Micro SD card slot.
8-NAND-Location.jpg
  1. Place the main board in a stand or holder and position it under a heat gun or device the blows super hot air. We use a Wagner "model XYZ" positioned approximately 2 1/2" - 3" inches away from the main board.
9-Positioning.jpg
  1. Monitoring the temperature the heat shield will come off easily between 190-200 Centigrade.
10-Temperature.jpg 11-HeatSheildRemoved.jpg
  1. Continue working under the high heat. In the 9300's I've worked on there is typically a black epoxy that has been applied to the NAND. Using a razor under the high heat this epoxy can be easily cut into. Once the epoxy has been cut and with the temperature around 215 Centigrade the NAND will be easily removed from the main board.
12-NANDRemoval.jpg
  1. The BlackBerry Curve 9300 uses a stacked die 152 pin BGA, this includes a NAND stacked on a controller which is soldered to the main board. We are interested in the NAND and therefore must separate it from the controller. This is accomplished with the use of high heat (heat gun), a 20 x 20 x 0.5cm steel plate and a 10cm razor blade.
  • Position the steel plate under the heat gun. The plate will heat up and hold the heat, try not to burn yourself.
  • Transfer the NAND+Controller to the plate and allow the chip to take in some heat ~1min
  • Using long tweezers to hold the chip and the 10cm razor begin slicing away the epoxy that is surrounding the chip with a sharp razor the epoxy will slice easily allowing you to see a tiny gap between the NAND and the controller.
13-3-EpoxyCleanup.jpg 13-4-EpoxyCleanup.jpg 13-5-EpoxyCleanup.jpg
13-1-EpoxyCleanup.jpg 13-2-EpoxyCleanup.jpg
  • The razor can then be used to separate the two.
14-Separation.jpg 15-Separated.jpg
  1. Using liquid flux, or flux paste and a soldering iron scrape the remaining epoxy off the NAND and clean it up real nice to prep for a NAND read.
16-1-SolderCleanup.jpg 16-2-SolderCleanup.jpg 17-AllClean.jpg