Chip-Off Forensics

    TSOP and BGA are packages that are commonly used to contain flash memory.

 

    TSOP (thin small outline package) NAND chips are “commonly found in thumb drives, SD cards, digital voice recorders, digital answering machines, and the iPhone 2 and 3G” and are “typically an easier type of memory chip to remove and read with chip-reading equipment” (Elder). These chips are easier to work with due to the “standardization of the TSOP memory architecture and pin configuration” (Elder). The TSOP chips have “connectors around the outer edge of the chip, and these are connected by soldering onto the motherboard. Removal from the board, as well as attachment to a chip-reading adapter, is relatively easy, and no rebuilding of the connectors is typically necessary” (Elder).

​

    In contrast, BGA (ball grid array) chips are more difficult to clean and read. In regards to its construction, a BGA chip “has multiple connectors on the underside of the chip, and these are soldered to the motherboard of the device. Additionally, they are often secured with epoxy, which makes the task more challenging. The BGA-style chip construction does not follow a common standard, but rather is developed by the chip manufacturers to their own discretion and demands of their handset customers” (Elder). Unfortunately for digital forensic examiners, the BGA chip is incredibly popular for mobile devices “due in part to its ability to store and manage high volumes of user data” (Elder). This means that when performing chip-off on a mobile device that has a BGA style flash memory chip, a difficult cleaning and a reballing process must occur so that the chip can properly connect to chip-reading equipment.

 

    Reballing the chip is necessary, as when a BGA chip “is removed from a PCB the balls on the chip are damaged. Some solder is left behind on the chip and the rest is left behind on the PCB. The result is that the balls have different sizes. These differences in size are a problem for most sockets. These sockets are designed for virgin chips with balls of equal size resulting in bad connections when an unprepared micro BGA chip is used” (Breeuwsma et al.). The reballing process aims to fix or replace of the balls on the underside of the chip. This can be accomplished by placing a special stencil on the pads, adding solder paste, and applying reflow so the paste forms and fixes balls in each pad (Willassen). To use this technique, it’s important that “the stencil match the ball size, inter-ball distance (pitch) and ball configuration of the chip. Since mobile phones have packages with different sizes and configurations, obtaining the right stencil can be quite difficult” thus adding another layer of difficulty when working with BGA chips versus TSOP chips (Willassen).