How to image an Embedded Multi Media Card (eMMC)

Embedded MultiMediaCard (eMMC) chips are located in many devices, such as gaming consoles, IoT, mobile phones, and smart TVs. Imaging and extracting data from these devices can often be challenging. Traditional storage devices (such as hard drives and USBs) can easily be mounted locally on a machine before being imaged. However, this is not the case with embedded devices. Both eMMC and NAND chips must have the compatible controller to read and extract the data, as they are flash storage devices. However, the eMMC has the controller embedded. In practice, the chip contains every necessary component compared to NAND.

Samsung's new 128GB eMMC 5.0 storage targets the lower end - SlashGear

eMMC chips (as shown above) are soldered onto the PCB, which means that they must be removed using high temperature combined with flux. From thereon, the chip must be cleaned and inserted into a compatible reader. Dolphin Data Lab offers an “all in one” eMMC reader, which supports a series of different chips.

The first step is to identify the eMMC on the PCB. In the images above, a PCB from a Nintendo WiiU is used for demonstrational purposes. The eMMC can easily be identified by either conducting some research on the chip names or by experience. eMMC chips usually have a unique shape, design, and a common size compared to other chips. In practice, they can easily be identified. After identification, the next step is to remove the chip from the PCB. This is commonly known as “chip-off”.

Using a hot air gun combined with flux for a few minutes will successfully extract the chip with minimum damage. However, the heat from the hot air gun must not exceed ~300 degrees celsius, as it may damage the chip.

With enough patience, the chip is removed from the PCB. However, the chip’s connectors are somewhat damaged and oxidised. Therefore, they must be cleaned using a soldering iron, flux, and a brush.

Cleaning the chip’s connectors can be somewhat difficult. However, some flux, a soldering iron, a toothbrush, and a cloth is used to clean most of the connectors. It is not perfect, but it will get the job done.

The eMMC reader must be adjusted to fit the specific chip, as there is a variety of shapes. The eMMC reader can then be inserted into an SD-card slot for imaging.

The eMMC was successfully imaged using dc3dd. The chip’s size is 32GB, as shown above. The image can be carved and extract data from using tools such as binwalk, scalpel, foremost, dd, or any other tool which supports file carving.

Conclusion

Even though embedded systems do not contain traditional storage devices, it is still possible to extract data. This can be conducted using a technique called “chip-off”. The eMMC chip is extracted from the PCB and cleaned before being imaged. Imaging an eMMC chip can easily be conducted using specialised hardware tools. However, there are other manual methods to image these chips if necessary.