Removing/Decapping an epoxy blob - Page 1
Forum section: electronics / general

author: Halcyon
author_rank: Unknown
timestamp: February 19, 2019, 08:48:45 am
content: I have a need to get at a chip underneath a blob of epoxy. The epoxy itself has a matte finish, as opposed to the glossy type you generally find in calculators etc... but otherwise is of the same "blobby" appearance.Is there anything I can do to safely get to the chip underneath, in this case it's a NAND chip, without damaging the chip itself?

author: Rerouter
author_rank: Super Contributor
timestamp: February 19, 2019, 09:10:24 am
content: Its not easy, even with the proper stuff (fuming nitric acid) Its very hard to not damage bond wires unless you have had many practice runs, not to mention it is not a chemical you want to have unless you understand its risksOne thing you may be able to try if it is a grey epoxy would be soaking in an agressive solvent like MEK (Methy Ethyl Ketone), It will not make it dissapear, but soften it enough that you can start to clean it off with other methods a few 10's of microns at a time (have done it this way for some boards I had to repair, took 1 night and 1 day, let it soak, when i had time, used a sacrificial tooth brush to scrub off some more of the epoxy, put it back in and so on, if you do it this way, do not store the toothbrush in with the solvent while waiting)Is the reason for accessing the nand chip data recovery, or curiousity? this will change things a fair bit, Equally when you say damage the chip, do you want it to stay functional, or just a complete silicon die.

author: frozenfrogz
author_rank: Frequent Contributor
timestamp: February 19, 2019, 09:18:39 am
content: Some epoxies soften when heated. Try hitting it with hot air (150°C) and see if it softens.The stuff used to bury bare ICs usually tends to be some tough MFer though.If you really need to get a detailed look on the chip, I would recommend xraying.Since the epoxy is designed to stick to the die and bond wires, every crack in the epoxy means potential cracking of the die.

author: Halcyon
author_rank: Unknown
timestamp: February 19, 2019, 09:36:03 am
content: Quote from: frozenfrogz on February 19, 2019, 09:18:39 amI tried a hot air station set to 300°C. The epoxy held on fast.I not only need to look at the chip, but I need to access the pins/bond wires so an x-ray won't help me other than to confirm whether the chip inside is cracked or not.Quote from: Rerouter on February 19, 2019, 09:10:24 amIt's a black epoxy. I don't really want to start using acids.Data recovery purposes. It's not *that* critical. It's important, but not so important to spend days or a lot of money doing it. Part of it is to practice my methods as well.I confirmed that it's not the controller, I swapped that chip with a known-good one and same issues.

author: Rerouter
author_rank: Super Contributor
timestamp: February 19, 2019, 09:43:31 am
content: black epoxy that is stable at high temperatures, At this point I can only recommend the slow solvent method, at a guess its a more chemically inert one than the one I mentioned, but it will slowly break down. Buy some MEK or Methylene chloride and take the slow road, If you want it somewhat automated, put it on something to slosh the solvent back and forth over the area, This way the bond wires should not be damaged,Just be aware mechanical abrasion speeds up the process a whole lot, but if you need every bond wire intact, then you need to go slow. and not do anything that could tear a bond wire.Equally both these solvents will eat through just about any plastic that sees either the liquid of the vapour, so plan where you want this to happen, and use metal containers where possible.

author: magic
author_rank: Super Contributor
timestamp: February 19, 2019, 10:00:43 am
content: They are tough mfers indeed. I once tried dichloromethane, which I found listed together with MEK and toluene as possible epoxy solvents, but it did nothing to the chips I tried. I left them soaked for two days only to discover that DCM is capable of escaping HDPE containers, apparently by diffusionThe only method I know which doesn't involve acid is heating to 500-600C to release the magic smoke which holds this epoxy together. But this is guaranteed to kill the chip (I tried).I would investigate the possibility of removing the controller chip and accessing the flash though the controller's PCB pads.

author: Halcyon
author_rank: Unknown
timestamp: February 19, 2019, 10:31:51 am
content: Quote from: magic on February 19, 2019, 10:00:43 amYou raise an excellent point. I might give this a go.

author: frozenfrogz
author_rank: Frequent Contributor
timestamp: February 19, 2019, 11:02:56 am
content: If access to the pads / bond wires is the prime directive, maybe also consider removing the PCB from the back instead of the epoxy blob.You might be able to sand down the PCB just to the point where the back of the traces is exposed.Start with 320 grit and then switch to wet sanding paper before exposing the copper layer.

author: Zero999
author_rank: Super Contributor
timestamp: February 19, 2019, 12:18:29 pm
content: Quote from: Halcyon on February 19, 2019, 09:36:03 amYou you want to dump the contents of the flash memory?Is this something you designed yourself?I don't know, isn't there a risk high temperatures can cause data loss?Perhaps the manufacturer can help.

author: amyk
author_rank: Super Contributor
timestamp: February 19, 2019, 12:20:12 pm
content: Matte finish suggests it's probably glass-filled epoxy.The requirement to preserve both the PCB and bond wires makes this much trickier... if you only needed the die intact (and could bond it onto something else afterwards), there are many other solvents that would work to dissolve everything else.

author: Halcyon
author_rank: Unknown
timestamp: February 19, 2019, 07:28:11 pm
content: Quote from: Zero999 on February 19, 2019, 12:18:29 pmNo it's not. It's a cheap and nasty USB key made in China. No idea who makes it or where it comes from. There are no descriptive markings on either the shell or the PCB. To be honest, I'm not surprised it failed.Quote from: amyk on February 19, 2019, 12:20:12 pmThis is a possibility (to bond the wires again later) but it's probably going to more effort than it's worth. The person who owns this should have backed up their data and not relied on a free give-away USB drive.

author: Benta
author_rank: Super Contributor
timestamp: February 19, 2019, 07:34:34 pm
content: The only substance I've had any luck with in dissolving epoxy is acetic acid. It converts the epoxy to brittle dust, but it takes quite some time (days). It needs to be used right on the spot, otherwise neighboring parts or the PCB may be damaged, so some kind of containment structure is necessary.

author: magic
author_rank: Super Contributor
timestamp: February 19, 2019, 08:09:56 pm
content: That's interesting, I'd like to try it.Room temperature, I suppose. What concentration?How did it affect metal like exposed bonding pads on the die, bonding wires, etc?

author: Benta
author_rank: Super Contributor
timestamp: February 19, 2019, 09:30:28 pm
content: Quote from: magic on February 19, 2019, 08:09:56 pmRoom temperature, yes. Careful, it's flammable.100% concentration.It doesn't really attack metal, but can leave a residue or a surface oxidation.EDIT: additives to the epoxy, like glass or other stuff may inhibit the process.

author: jayeye
author_rank: Contributor
timestamp: February 19, 2019, 10:26:10 pm
content: Before we start, I hope someone learned a lesson about the value of backups. Who keeps valuable data in a single location? Unless, of course, these are not *your* data, but I digressNormally the reason to expose a chip is to get access to its insides in a way that cannot be done by just accessing the bonding pads, which can be done by careful sanding of the outer layers of the epoxy. A prerequisite for that is knowing the layout of the chip. If you have only one copy, *and* you don't know what's inside, *and* you don't know which pads do what, *and* you want a copy of the data, I'd say forget it. Still, if this were the key to a billion dollars, here's what I would do:First, ask my dentist to take an xray, with the film as close to the back of the chip as possible. Another poster's suggestion to lap the PCB to get to the traces also applies here. In the unlikely event that this is a multi-layer PCB, keep track of exposed inner layers and where they go. I'd definitely want to get rid of all copper before I xray it, for best results.The xray would also tell me if there is any tamper-resistance built into the package. If there is, I have friends who have done this before and I would go to them for help; without A LOT of prior experience there is no way I would get past even the simplest TR protections, and it would only be worth it if national-security-level interests were at stake.Unless I got lucky and the epoxy is some inferior material, I would not even attempt to use any organic solvent. Hot WFNA it would be. Now, my parents were chemists, so I learned how to handle things like white fuming nitric acid (WFNA) as a kid, but that stuff is DANGEROUS, and common sense won't save you -- there is nothing commonsensical about the stuff. Then there is the problem of acquiring it and having it shipped to your location without getting on all sorts of watch listsThere can't have been only one of these things made. How did you get it? Why can't you get more?

author: apis
author_rank: Super Contributor
timestamp: February 20, 2019, 12:17:57 am
content: Wouldn't there be a risk that x-rays potentially flip memory bits and corrupt the data?

author: Halcyon
author_rank: Unknown
timestamp: February 20, 2019, 05:10:12 am
content: Quote from: jayeye on February 19, 2019, 10:26:10 pmI think someone did. Thankfully that someone isn't me. :-)Quote from: jayeye on February 19, 2019, 10:26:10 pmI have obtained donor drives of identical type/batch.Already this is looking like it's going to be too difficult for the amount of possible gain. I don't have days or weeks to spend on it. I think I'm just going to have to leave it there. I've tried all the "quick" things I can think of.

author: frozenfrogz
author_rank: Frequent Contributor
timestamp: February 20, 2019, 08:11:37 am
content: Would you mind sharing a picture or two and the full prerequisit?This changed from guessing you want to obtain a chip layout to 'me needs to access data'.Maybe there is a way you did not think of, but we are somewhat left to pokeing at it with a stick without a chance to understand the actual task.

author: Zero999
author_rank: Super Contributor
timestamp: February 20, 2019, 09:42:41 am
content: Quote from: Benta on February 19, 2019, 09:30:28 pmBe careful, 100% concentration acetic acid is much stronger than ordinary vinegar. It's very corrosive and can cause severe burns to the skin and eyes and the vapour can cause damage to the respiratory tract. Where all the necessary protective clothing and use in a well ventilated area.

author: HalFET
author_rank: Frequent Contributor
timestamp: February 20, 2019, 10:11:01 am
content: Quote from: magic on February 19, 2019, 10:00:43 amDCM on its own often doesn't get the job done, most commercial removers also throw in some dimethylformamide (DMF). Not sure what it exactly does, it does seem to make it more effective.

author: magic
author_rank: Super Contributor
timestamp: February 20, 2019, 10:51:58 am
content: Maybe becauseQuoteI didn't know about it and used pure DCM.

author: HalFET
author_rank: Frequent Contributor
timestamp: February 20, 2019, 05:08:01 pm
content: Quote from: magic on February 20, 2019, 10:51:58 amThat would definitely explain it!

author: coppercone2
author_rank: Super Contributor
timestamp: February 21, 2019, 01:58:48 pm
content: Quote from: jayeye on February 19, 2019, 10:26:10 pmrelax with the watch lists, unless you just came in from libya don't be scared of your own shadow because it makes everyone crazypeople NEED chemicals or you will be fucking hammered by service charges to 'professionals' at EVERY step. Even good drain cleaner or muratic acid.Yea I need some entitled certified professional to help me do this 'super dangerous' plating process on a piece of steel.

author: Halcyon
author_rank: Unknown
timestamp: February 21, 2019, 09:22:25 pm
content: Quote from: frozenfrogz on February 20, 2019, 08:11:37 amPhotos attached for anyone who is interested.Nothing has really changed, it's always been about accessing the data. That I can do easily, getting access to the NAND is the difficult part in this case.I've pretty much decided that this is a dead end. It's not really going to be worth the time or effort for the data that is on it. Even if I managed to get access to the chip, there is no guarantee that its even intact or the data is readable.I think the owner of this drive has learned a valuable lesson.

author: magic
author_rank: Super Contributor
timestamp: February 21, 2019, 11:18:01 pm
content: Web search brings up some production/debug tools for this controller and datasheets of similar parts so I think data recovery professionals may be able to help if the owner cares enough to fork out some $$$. Flash recovery seems to be a thing, I have seen ads.Or you can try to DIY.I don't understand your logic in decapping this damn thing. Everything needed to talk to it should already be brought out to that SOIC.

author: NiHaoMike
author_rank: Super Contributor
timestamp: February 21, 2019, 11:33:05 pm
content: Quote from: Halcyon on February 21, 2019, 09:22:25 pmIt looks like you can just remove the controller to gain access to the flash pins.

author: amyk
author_rank: Super Contributor
timestamp: February 22, 2019, 01:12:43 am
content: Remove controller, solder wires and connect to universal programmer. Should then be easy to tell if the flash itself is dead or not.

author: Halcyon
author_rank: Unknown
timestamp: February 22, 2019, 02:16:04 am
content: Quote from: magic on February 21, 2019, 11:18:01 pmI've tried those tools, they don't recognise the NAND. The controller is working as it should.Quote from: amyk on February 22, 2019, 01:12:43 amGreat idea. I'll give this a go.

author: tsman
author_rank: Frequent Contributor
timestamp: February 22, 2019, 03:20:49 am
content: I couldn't find the CBM2199 datasheet and the manufactuer even doesn't list it on their website. There is a datasheet for a larger CBM2098E and a list of compatible flash chips for the CBM2199 from 2017. It looks like the CBM2199 only supports 8-bit async NAND which makes it a bit easier.If you do gain access to the contents of the flash chip, you'll still need to at least partially reverse engineer the controller wear leveling and ECC to make sense of it. This will then have the usual filesystem churn on top caused by the owner modifying files on the stick.Give it a go but this person will have to accept that chances of success will be very low. If you do manage it then they owe you big time for the heroic data recovery efforts.

author: magic
author_rank: Super Contributor
timestamp: March 24, 2019, 01:45:38 pm
content: I did an experiment with 99.5% "glacial" acetic acid. Here's the results after one week of submersion:Aluminium foil: appears unaffected, still shiny.Clear epoxy resin: fragile and brittle, easily broken with bare fingers.Copper: appears unaffected although some attack must be taking place because the liquid turned cyan.A piece of DIP package: well, here's where problems begin. I could break it but only maybe a tiny bit easier than before the acid and certainly not easily enough to confidently recover dies.I dropped that piece of DIP back and will check it again after a month or two.Meanwhile, I will probably experiment with heating that stuff. Per some chemical compatibility charts I found, epoxy is supposed to become more vulnerable to various carboxylic acids at elevated temperatures. Yes, acetic is flammable. I'll only use small quantity and some place where fire is no issue.And before someone mentions nitric/sulfuric, it can only be bought illegally here for whatever reasons