Chip-Off BlackBerry Curve 9300

From Forensics Wiki
Jump to: navigation, search

Tear Down

  1. Remove the back panel.
  2. Remove the SIM and SD Memory Card.
  3. Using a torx-6 screw driver remove the 2 visible screws on the back of the phone.
1-ScrewRemoval.jpg
  1. Remove the screen protector using a plastic shim or guitar pick.
2-PlasticScreen.jpg
  1. Use the shim to detach the top-plate/cover from the device.
3-TopPlate.jpg
  1. Remove 4 additional torx-6 screws.
4-ScrewRemoval.jpg
  1. Detach vendor plate and remove 2 more torx-6 screws.
5-ScrewRemoval.jpg
  1. Separate back plate from the main board.
6-SeperateBoard.jpg
  1. The tear down is now complete
7-TearDownComplete.jpg

NAND Removal

  1. Peel off the vendor sticker on the back side of the main circuit board
  2. The NAND is located beneath the heat shield directly above the Micro SD card slot.
8-NAND-Location.jpg
  1. Place the main board in a stand or holder and position it under a heat gun or device the blows super hot air. We use a Wagner "model XYZ" positioned approximately 2 1/2" - 3" inches away from the main board.
9-Positioning.jpg
  1. Monitoring the temperature the heat shield will come off easily between 190-200 Centigrade.
10-Temperature.jpg 11-HeatSheildRemoved.jpg
  1. Continue working under the high heat. In the 9300's I've worked on there is typically a black epoxy that has been applied to the NAND. Using a razor under the high heat this epoxy can be easily cut into. Once the epoxy has been cut and with the temperature around 215 Centigrade the NAND will be easily removed from the main board.
12-NANDRemoval.jpg

The BlackBerry Curve 9300 uses a stacked die 152 pin BGA, this includes a NAND stacked on a controller which is soldered to the main board. We are interested in the NAND and therefore must separate it from the controller. This is accomplished with the use of high heat (heat gun), a 20 x 20 x 0.5cm steel plate and a 10cm razor blade.

  1. Position the steel plate under the heat gun. The plate will heat up and hold the heat, try not to burn yourself.
  2. Transfer the NAND+Controller to the plate and allow the chip to take in some heat ~1min.
  3. Using long tweezers to hold the chip and the 10cm razor begin slicing away the epoxy that is surrounding the chip with a sharp razor the epoxy will slice easily allowing you to see a tiny gap between the NAND and the controller.
13-3-EpoxyCleanup.jpg 13-4-EpoxyCleanup.jpg 13-5-EpoxyCleanup.jpg
13-1-EpoxyCleanup.jpg 13-2-EpoxyCleanup.jpg
  1. The razor can then be used to separate the two.
14-Separation.jpg 15-Separated.jpg
  1. Using liquid flux, or flux paste and a soldering iron scrape the remaining epoxy off the NAND and clean it up real nice to prep for a NAND read.
16-1-SolderCleanup.jpg 16-2-SolderCleanup.jpg 17-AllClean.jpg