Free evaluation No recovery, no charge Free shipping to the lab Temecula and San Diego, CA. Mail-in service nationwide.

NAND flash and chip-off data recovery

When the device around the memory is dead, the data is usually still in the NAND chip. We read flash memory directly, at chip level, and rebuild the files.

  • Free evaluation
  • No recovery, no charge
  • Free shipping to the lab

What NAND flash is and where it lives

NAND flash is the memory inside almost every modern storage device: USB sticks, SD and microSD cards, SSDs, phones, tablets, dash cams, drones, voice recorders, game consoles and the control units in vehicles and machinery. It stores data as electrical charge in billions of tiny cells.

SLC, MLC, TLC and QLC
The number of bits stored in each cell: one, two, three or four. More bits per cell means more capacity for the money and less tolerance for wear and time.
3D NAND
Current chips stack cells vertically, with well over 200 layers in recent generations. Capacity per chip has grown enormously and so has the error correction needed to read it back.
eMMC and UFS
A NAND chip and its controller in one soldered package. eMMC is found in older phones, budget laptops, tablets and embedded devices. UFS is its faster replacement in current phones and thin laptops.
Monolithic devices
Controller and memory sealed in one block with no separate chip. All microSD cards and most slim USB sticks.

Why reading a chip is only the start

A NAND chip never holds your files in order. The controller scatters data across the chip to spread wear, keeps spare copies, marks bad blocks, scrambles the bit pattern and adds error-correction codes to every page. After a chip is read, all of that has to be undone before a single photo or document appears.

Our methods

  1. Controller-level access. Where the controller still responds, we put it into its factory diagnostic mode and repair or rebuild the translation tables. The data comes out already decoded. This is the main route for modern SSDs.
  2. Chip-off. The NAND chip is removed from the board with controlled heat, cleaned and read in a dedicated reader. We correct bit errors with repeated tuned reads, then reverse the scrambling, page layout and block order to assemble a working image.
  3. Monolith recovery. For microSD cards and one-piece USB sticks we remove the protective coating, find the technological contacts and connect to them with hair-thin wires under a microscope. The memory is then read as in chip-off.
  4. Direct eMMC and UFS reads. These chips can often be read in place through test points on the board, without removing them, or removed and read in an adapter.
  5. File system rebuild. The image is turned back into folders and files, and damaged video, photos and databases are repaired where possible.

When chip-off will not work

Chip-off recovers what is stored on the chip. On devices that encrypt their storage in hardware, that is unreadable ciphertext without the key held by the device's own processor.

This applies to every current iPhone and iPad, Android phones from roughly 2017 onward, Macs with a T2 chip or Apple silicon, and most current NVMe SSDs. For these the right approach is to repair the original device or controller far enough to let it decrypt its own data. We explain which route applies to your device before any work begins. See mobile phone recovery, Mac recovery and SSD recovery.

Devices that respond well to NAND-level recovery

  • USB flash drives and memory cards of every type
  • Older SATA SSDs and many budget SSDs without hardware encryption
  • Dash cams, body cams, drones and action cameras
  • Voice recorders, GPS units and e-readers
  • Older phones and tablets with unencrypted eMMC storage
  • Game consoles and handhelds with eMMC storage
  • Industrial CompactFlash and embedded storage modules
  • Fire, water and crush damaged devices of all kinds

Chips and controllers we work with, 2013 to 2026

The flash memory generations and controller families behind the devices we recover, by the years they were in production. The part number is laser-etched on top of the chip itself, so the device normally has to be opened to read it.

YearsRangePart numbers and generations
2013–2016Planar (2D) NAND, MLC and TLCLast planar generations before 3D NANDToshiba / SanDisk 19nm, Toshiba / SanDisk A19nm, Toshiba / SanDisk 15nm, Micron / Intel 20nm, Micron / Intel 16nm, Samsung 19nm, Samsung 16nm, SK hynix 16nm
2013–2017Phison USB flash drive controllersPS2251-67 and -68 are USB 2.0; -03 and -07 are USB 3.0PS2251-67, PS2251-68, PS2251-03, PS2251-07
2013–2017SandForce and Marvell SATA SSD controllersSATA 6Gb/s controllersSF-2281, 88SS9187, 88SS9189, 88SS1074
2013–2020Silicon Motion, Alcor and Innostor USB flash drive controllersSM3257EN and AU6989 are USB 2.0 controllersSM3257EN, SM3267, SM3271, SM3281, AU6989, IS903, IS917
2013–2026Phison SATA SSD controllersSATA; PS3111-S11 is DRAM-lessPS3108-S8, PS3110-S10, PS3111-S11
2013–2026eMMC memory (Samsung, Kioxia / Toshiba, Micron)Controller and NAND in one BGA packageKLMAG2GEAC-B001, KLMAG1JETD-B041, KLMBG2JETD-B041, THGBMHG8C2LBAIL, THGAMSG9T15BAIL, THGAMST0T25BAIL, MTFC32GAPALBH-IT
2014–2018First 3D NAND generationsMLC and TLC 3D NANDSamsung V-NAND 32-layer, Samsung V-NAND 48-layer, Samsung V-NAND 64-layer, Micron / Intel 32-layer, Micron / Intel 64-layer, Toshiba / WD BiCS3 64-layer, SK hynix 72-layer
2014–2026Silicon Motion SATA SSD controllersSATA; XT versions are DRAM-lessSM2246EN, SM2256, SM2258, SM2258XT, SM2259XT
2015–2026UFS memory (Samsung, SK hynix, Kioxia / Toshiba)UFS 2.1 to UFS 3.1 packages used in phonesKLUCG4J1ED-B0C1, KLUDG4UHDB-B2D1, H28U74301AMR, THGAF4G9N4LBAIR, THGJFPT0E18BAIP, THGJFPT1E28BAIP
2016–2020PCIe 3.0 NVMe controllers (Phison, Silicon Motion)PCIe 3.0; E13T and SM2263XT are DRAM-lessPS5007-E7, PS5008-E8, PS5012-E12, PS5013-E13T, SM2260, SM2262EN, SM2263XT
2018–20223D NAND, 90 to 176 layersTLC and QLC 3D NANDSamsung V-NAND V5 (90+ layers), Samsung V-NAND 176-layer, Micron 96-layer, Micron 176-layer, Kioxia / WD BiCS4 96-layer, Kioxia / WD BiCS5 112-layer, SK hynix 128-layer, YMTC 128-layer
2019–2024PCIe 4.0 NVMe controllers (Phison, Silicon Motion, InnoGrit, Maxio)PCIe 4.0; E21T, E27T, SM2269XT and MAP1602 are DRAM-lessPS5016-E16, PS5018-E18, PS5021-E21T, PS5027-E27T, SM2264, SM2269XT, IG5236, MAP1602
2022–20263D NAND, 162 layers and aboveTLC and QLC 3D NANDSamsung V-NAND 236-layer, Samsung V-NAND 286-layer, Micron 232-layer, Micron 276-layer, Kioxia / WD BiCS6 162-layer, Kioxia / SanDisk BiCS8 218-layer, SK hynix 238-layer, SK hynix 321-layer
2022–2026PCIe 5.0 NVMe controllers (Phison, Silicon Motion)PCIe 5.0; E31T and SM2504XT are DRAM-lessPS5026-E26, PS5028-E28, PS5031-E31T, SM2508, SM2504XT

Not listed? These are examples, not limits. If your model is missing we almost certainly still recover it. Give us the number when you start a case.

A track record in NAND recovery

RMLD has an established record in NAND recoveries and continues to invest in research, development and training as chip designs change. Call (951) 595-8065 for advice, or start a case and tell us about the device.

How a case works

Six steps from the first call to your files. You approve the quote and check the results before paying.

  1. Tell us what happenedCall or start a case online. A technician reviews it and tells you how to send or bring the device.
  2. Ship it or drop it offShipping to the lab is free. You can also hand it in at Temecula or San Diego.
  3. Free evaluationWe diagnose the fault and send a firm quote. Nothing is charged for this.
  4. Recovery in our labOnce you approve, the work is done in-house. Your device never leaves our company.
  5. You check the filesYou receive a list of what was recovered and confirm it before paying.
  6. Data returnedOn a new drive, your own drive, or by encrypted download. No recovery means no charge.

Talk to a technician before you try anything else

The evaluation is free, and the first advice you get can decide whether the data comes back.

CallStart a case