By Julia Iv
A technician installs a replacement logic board, turns on the phone, and takes a test photo. The camera works. The photos from last night’s game are still in a parts tray, on the board that just came out of the phone.
If those were the only copies, data recovery belongs on the repair ticket. A shop fixing a phone for daily use can replace an entire board. A recovery specialist might spend hours repairing one circuit on a board nobody expects to use again. It only has to run safely long enough for the owner to unlock the phone and copy the files.
What a chip reader actually gets
In a chip-off acquisition, a technician removes the flash storage and reads it separately. Some older or unencrypted devices yield readable files this way. With a modern encrypted phone, a lab can copy every byte of a photograph without producing anything an image viewer can open. That raw copy of NAND flash or Universal Flash Storage (UFS) still has value for low-level analysis.
On an iPhone, the Secure Enclave uses a device-specific key, the UID, to protect other keys, including those securing the file system. Apple fuses the UID into the system on a chip during manufacturing. A debugger cannot read it out. Move the storage to an identical donor iPhone and you can have the right files and the right passcode on a device with the wrong hardware key.
On Android, phones that shipped with Android 10 or later must use file-based encryption. On a PIN-protected phone, an alarm can sound after a restart even while photos in credential-encrypted storage remain inaccessible until the owner enters the PIN. Supported models can also wrap file-encryption keys so only the device’s hardware can unwrap them. Android’s KeyMint can run sensitive key operations in a trusted execution environment or in dedicated StrongBox hardware. For recovery, enough of the original electronics must work together to boot trusted software and unlock the requested files.
How much of the original board needs to work?
A specialist usually stops at the first step that allows a safe copy.
- Use an existing connection. If the owner can authorize a file transfer over USB, the case can stay closed.
- Try a known-good peripheral. A black screen can hide a working board. A test display may let the owner enter the passcode and approve the transfer.
- Repair the fault on the original board. A failed voltage regulator can keep an intact processor from starting. Replacing that one part may restore stable power long enough to copy the files.
- Rebuild damaged connections. A torn connector can pull away the copper trace beneath it. A specialist may rebuild that trace, restore a power rail, or reconnect a signal path between board layers.
- Consider a donor-board transplant. When the circuit board is beyond repair, its surviving security and storage chips may still work together on a compatible board.
A factory restore can erase the only copy. Even an update that preserves the files can change which acquisition methods work with the installed operating system. With recovery on the ticket, a specialist has a reason to defer both.
What a donor board can supply
Most donor parts have no cryptographic role. A capacitor, shield, connector, or voltage regulator can come from a compatible board. A donor can even supply an intact section of circuit board. In a transplant, its role changes. The donor becomes the working board onto which the specialist moves the phone’s original critical components.
The repair lab iPad Rehab describes moving the original processor and NAND storage together with an EEPROM, a small chip that holds configuration data. Other designs can depend on a different security chip. If a quote says “CPU/NAND transplant,” ask which original parts this model needs and whether they survived. A successful transplant still leaves the owner’s passcode protection in place.
Which shop should handle the phone?
A general repair shop may use manufacturer diagnostics and repair connectors in-house while sending complex board faults elsewhere. Ask what the repair warranty covers and who will handle the original board if it leaves the shop.
A board-level recovery specialist may use thermal imaging to locate a fault, then separate a stacked board for microsoldering. Discuss what counts as a successful recovery, who can see the files, how you’ll receive them, and which irreversible steps need separate approval. If the shop needs your passcode, ask whether you can enter it yourself.
A forensic laboratory must account for how it obtained the evidence. The examiner documents the legal authority for the search, records who handled the phone, uses validated methods, and controls access to the evidence. A cryptographic hash lets another examiner check whether the acquired copy has changed. Ask what the examiner is qualified to do and whether any accreditation the lab claims covers the proposed work.
NIST’s 2014 guide puts chip-off at Level 4 in its acquisition framework. The level describes how the bytes were obtained. It tells you little about whether a lab can open files on a current locked phone. Even with a platform such as Cellebrite Inseyets UFED, the examiner must establish both legal authority and support for the specific model, operating system, and lock state.
If last night’s game is what matters, say so at the counter. “My priority is the photos and videos from last night’s game. Please keep the original board and call me before a restore, a board replacement, or a chip transfer.” At pickup, open one of those files from the delivered copy on a second device.