SAMSUNG KLM1G1CEHC-B101 (153FBGA)

[cheadledatarecovery]

Hello,

We have one of the following 153 BGA chips in on a voice recorder. The voice recorder has failed, and deleted data is required from the chip. Consequently chip removal is required.

SAMSUNG KLM1G1CEHC-B101 (153FBGA)
As per:
http://flash-extractor.com/forum/viewtopic.php?t=6161


We do not have the adapter for this chip and some of contacts I have in the DR industry do not hold it either as it is a rare model of chip to receive in. Acquiring the correct adapter for what is likely to be a one off job is not useful in this case.

Does anyone in the UK have the appropriate adapter? If so I can pass on your details to the customer.

Regards,
John

[Rayms]

this is eMMC chip. you can read over SD card reader. just solder a little bit pin.

[HaQue]

this is eMMC chip. you can read over SD card reader. just solder a little bit pin.

plus others
• MultiMediaCard System Specification Ver. 4.3 compatible (Boot operation is supported)
• Full backward compatibility with previous MultiMediaCard system ( 1bit data bus, multi-moviNAND systems)
• Data bus width : 1bit(default), 4bit and 8 bit


I think this is the datasheet, it may help.

201144131450191.pdf

(332.27 KiB) Downloaded 680 times

The files or data image may be tricky to get back, but would be an interesting case

The embedded flash mangement software or FTL(Flash Transition Layer) of moviNAND manages Wear Leveling, Bad Block Management and ECC. The FTL supports all features of the Samsung NAND flash platform and achieves optimal performance.

Not sure how much of this is reverse engineered already.

[fzabkar]

It could be easier and cheaper to find someone to repair the voice recorder. I could at least help you with some rudimentary checks.

[HaQue]

I agree with fzabkar

[cheadledatarecovery]

Hi there,

Thanks for the reply. In this case the customer requires deleted data from the voice recorder. This was deleted shortly before the voice recorder failed. There is an 'erase' button which is quite prominent and it will format the device if depressed.

This particular voice recorder has no USB interface so there would not be a straight forward way to get the device into a mass storage mode to attempt the recovery of the deleted files.

Given what you have noted regarding this chip being eMMC and wiring in as per a SD I wonder if the areas I have highlighted in red on the attached image are likely to be leading into the appropriate pins for the SD connection?

[fzabkar]

The SAMSUNG moviNAND is an embedded MMC solution designed in a BGA package form. moviNAND operation is identical to a MMC card and therefore is a simple read and write to memory using MMC protocol v4.3 which is a industry standard. moviNAND consists of NAND flash and a MMC controller. 3V supply voltage is required for the NAND area (VDDF) whereas 1.8V or 3V dual supply voltage (VDD) is supported for the MMC controller.

You don't need to remove the chip. You only need to remove the daughter PCB that it sits on. Just treat the daughter PCB as an MMC card.

ISTM that the chip is configured in 4-bit mode with a single 3.3V supply. I would confirm that the +3.3V and Ground pins are correctly identified by measuring their voltages in-circuit.

The order of the data pins (DAT0 - DAT3) is not clear to me, but I would expect that they would be sequential. AFAICT, you won't damage anything if you get the order wrong.

Measure the resistance of the CLK resistor. That should confirm the identity of the CLK pin.

BTW, the model number of the voice recorder may help us to locate a service manual and/or a circuit diagram.

Attachments

[HaQue]

being on a daughterboard I think is a bonus, interested to see how you go after following fzabkars advice. Nice to potentially see eMMC used properly as intended.

[fzabkar]

being on a daughterboard I think is a bonus, interested to see how you go after following fzabkars advice. Nice to potentially see eMMC used properly as intended.

Do you think there is any possibility of sending a data destructive command to the eMMC if the DATA pins are wired in the wrong order?

[data-medics]

Arviaka is actually working on an almost identical chip for me right now. Only the one I had was from a Huawei phone.

[fzabkar]

Arviaka is actually working on an almost identical chip for me right now. Only the one I had was from a Huawei phone.

ISTM that this job is trivial insofar as retrieving the raw data is concerned. The OP just needs to connect 8 wires from the daughterboard to a card reader that he could probably find on eBay for $10. I can't imagine that the Huawei phone would be that much different in principle. The file system and audio format might present additional challenges in both cases, though.

I could have been more helpful if I had a circuit diagram, but the OP appears to want to keep the model number a secret. AFAICT, the voice recorder is a Japanese design (Panasonic or Sanyo, possibly Sony) and was manufactured in late 2010.

FWIW, here are the datasheets for some of the power control ICs:

MTM862270LBF, Panasonic, N-ch MOSFET, RDSon 80mohm, marking JF, 20V, 2.2A, WSSMini6-F1 package:
http://www.semicon.panasonic.co.jp/ds4/MTM86227_E.pdf
http://www.maoye-smd.com/canshu/pdf/201 ... M86227.pdf

XC9103D091Dx, Torex Semiconductor, step-up DC-DC converter, no current limit, 0.9V feedback, 100kHZ, marking 6D091, USB-6P package:
http://www.torex.co.jp/english/products ... 3~9105.pdf

XC6209D28ADx, Torex Semiconductor, 2.8V LDO regulator, 150mA, USB-6P package, marking 09D28:
http://www.torex.co.jp/english/products ... 209_12.pdf
http://www.torex.co.jp/english/products ... XC6209.pdf

The "VHW" IC appears to be a power switch of some kind, with what looks to be a slow start feature. AFAICT there should be +3.3V on either side of it.

[HaQue]

being on a daughterboard I think is a bonus, interested to see how you go after following fzabkars advice. Nice to potentially see eMMC used properly as intended.

Do you think there is any possibility of sending a data destructive command to the eMMC if the DATA pins are wired in the wrong order?

Unlikely, they are probably sequential like you said

[arvika]

If embedded controller inside eMMC chip works, data recovery is not so hard. But if controller not work, it is problem, we must find pinout directly to nand.

[fzabkar]

being on a daughterboard I think is a bonus, interested to see how you go after following fzabkars advice. Nice to potentially see eMMC used properly as intended.

Do you think there is any possibility of sending a data destructive command to the eMMC if the DATA pins are wired in the wrong order?

Unlikely, they are probably sequential like you said

The order could be ascending or descending.

[cheadledatarecovery]

Thanks for all the replies, currently working on this one - definitely a job for a wet Sunday afternoon. Will be in touch with results shortly.

[cheadledatarecovery]

I have the daughter board wired into a bread-board. At the moment I can't get a hardware ID. Regarding the order of the DAT, there are a total of 24 combinations in order. I have not started working my way through these methodically on the hope that someone else might have one of these working. I shall carry on working through the possible combinations tomorrow.

Thanks,
J

[fzabkar]

I have the daughter board wired into a bread-board. At the moment I can't get a hardware ID. Regarding the order of the DAT, there are a total of 24 combinations in order.

4 bits give 16 combinations, not 24.

http://www.google.com.au/search?q=2%5E4

I have not started working my way through these methodically on the hope that someone else might have one of these working.

Why not just tell us the model number of the voice recorder? Then someone might know if they have "one of these".

[cheadledatarecovery]

Sorry I had forgotten to, model:
Olympus VN-750.

Best regards,
J

[fzabkar]

4 bits give 16 combinations, not 24.

Sorry, another brain fart. The number of combinations is 4 x 3 x 2 x 1 = 24.

BTW, I checked my usual sources for service manuals and circuit diagrams, but I found nothing.

If at all possible, you could try to trace the data pins back to the microcontroller. The order of the pins should be sequential there.

[fzabkar]

Olympus VN-750 1GB Digital Dictaphone - £14.99 at Argos:

http://www.hotukdeals.com/deals/olympus ... os-1801429

... or £24.99 at Amazon:

http://www.amazon.co.uk/Olympus-VN-750- ... B007UPLST0