eMMC Data Recovery
BGA-Soldered Managed NAND in Chromebooks, Tablets, and Embedded Devices
eMMC chips are soldered directly to the motherboard. When the board dies or the eMMC controller locks out, the storage cannot be removed like a standard SSD. We recover eMMC data through ISP (In-System Programming) via test points on the board, or by desoldering the BGA chip and reading the NAND directly with PC-3000 Flash.
No Data, No Charge. Free evaluation for all eMMC devices.
What Is eMMC Data Recovery?
eMMC (embedded MultiMediaCard) is a managed NAND flash storage package soldered to a device's motherboard as a BGA (Ball Grid Array) component. The chip combines a NAND flash die, a flash controller, and the MMC interface into a single package defined by the JEDEC eMMC 5.1 standard. Chromebooks, budget laptops, tablets, smart TVs, set-top boxes, and IoT devices use eMMC as their primary storage.
When the host device fails, the eMMC chip cannot be removed and plugged into a reader like an SSD or SD card. Recovery requires either connecting to the chip's data lines through ISP test points on the PCB, or desoldering the BGA package and mounting it in a chip reader. Both methods bypass the dead host board and communicate with the eMMC controller directly using the MMC protocol.
eMMC Architecture
Understanding the internal design of eMMC storage explains why recovery requires board-level access and why it differs from SSD or SD card recovery.
| Spec | eMMC | eUFS | SATA SSD |
|---|---|---|---|
| Interface | Parallel MMC bus (8-bit) | Serial SCSI (M-PHY lanes) | SATA III (serial ATA) |
| Protocol | MMC command set (JEDEC 5.1) | UFS command set (SCSI) | ATA command set |
| Max throughput | 400 MB/s (HS400) | 2,900 MB/s (UFS 3.1) | 550 MB/s (SATA III) |
| Duplex | Half-duplex | Full-duplex | Half-duplex |
| Typical capacity | 16 GB to 256 GB | 64 GB to 1 TB | 120 GB to 8 TB |
| Mounting | BGA soldered to board | BGA soldered to board | Removable (2.5" or M.2) |
| Recovery tool | PC-3000 Flash + ISP/BGA adapter | PC-3000 Flash + UFS adapter | PC-3000 SSD / PC-3000 Portable |
Managed NAND
"Managed NAND" means the eMMC package contains its own flash controller that handles wear leveling, ECC, bad block management, and garbage collection internally. The host device sends standard MMC read/write commands; the eMMC controller translates these to raw NAND page operations. This is the same principle as an SSD, but in a smaller BGA form factor with lower performance targets. When the internal controller fails, the data on the NAND is intact but the MMC interface stops responding.
BGA Package
eMMC chips use a Ball Grid Array solder connection with 153 or 169 solder balls on the underside of the package (defined by the JEDEC standard). These balls connect power, ground, clock, command, and 8 data lines to the host board. The solder joints are approximately 0.35 mm in diameter. Removing the chip for chip-off recovery requires a hot-air rework station at 260-280°C with appropriate flux and preheating to prevent thermal shock to the NAND die.
Devices That Use eMMC Storage
eMMC is the default storage in cost-optimized devices. When these devices fail, the data is trapped on a chip that cannot be removed without microsoldering equipment.
Chromebooks
Google Chromebooks from Samsung, Acer, HP, Lenovo, and ASUS use 32 GB to 128 GB eMMC chips as their sole internal storage. Common models include the Acer Chromebook 311, HP Chromebook 14, Samsung Chromebook 4, and Lenovo Chromebook S330. When the motherboard fails due to a power surge, liquid spill, or component failure, the user's local files, Downloads folder, and Linux container data are locked on the eMMC chip.
Budget Laptops
Windows laptops under $400 frequently use eMMC instead of SATA or NVMe SSDs. HP Stream 11 and 14, Lenovo IdeaPad 1, ASUS VivoBook E210, and Acer Aspire 1 ship with 32 GB or 64 GB eMMC. These laptops store Windows system files and user data on the same eMMC chip. A failed board means the Windows installation, documents, and photos are inaccessible without ISP or chip-off recovery.
Tablets
Android tablets, Amazon Fire tablets, and Windows tablets use eMMC storage. Samsung Galaxy Tab A, Amazon Fire HD 10, Lenovo Tab M10, and Microsoft Surface Go (base model) all use eMMC. Tablets are prone to drop damage and charging port failures that kill the main board while the eMMC data remains intact.
Smart TVs and Set-Top Boxes
Smart TVs from Samsung, LG, and Vizio store firmware, apps, and configuration data on eMMC chips. Streaming devices like Roku, Amazon Fire TV Stick, and Android TV boxes use 8 GB to 32 GB eMMC storage. Recovery is relevant for commercial displays with custom configurations or digital signage systems that store scheduled content locally.
IoT and Embedded Systems
Single-board computers (Raspberry Pi Compute Module, BeagleBone Black), industrial gateways, POS terminals, kiosks, and automotive infotainment systems use eMMC for boot and data storage. Industrial eMMC chips from Micron, Samsung, and Kingston run for years in harsh environments. When they fail, the device's firmware, configuration, and operational data need to be recovered to restore functionality or investigate failures.
Dash Cameras and GPS Units
Some dash cameras and GPS navigation units store recorded footage and map data on internal eMMC rather than a removable SD card. When the device dies from a power surge or heat exposure (common in car-mounted electronics), the footage on the eMMC requires chip-level recovery. This is relevant for accident investigations where the dash cam footage is needed as evidence.
Common eMMC Failure Modes
eMMC failures fall into four categories. The failure type determines whether we recover through ISP (communicating with the chip's controller in place) or chip-off (bypassing the controller entirely).
Controller Lockout
The eMMC controller enters a locked state where it refuses standard MMC read commands. This happens after firmware corruption, unexpected power loss during a firmware update, or when the controller's internal table (the Flash Translation Layer) becomes inconsistent. The host device may report "no storage detected" or boot into a recovery screen.
Recovery approach: Connect via ISP to the eMMC's CMD and DAT lines. Send MMC vendor commands to unlock the controller or put it into a diagnostic mode that allows raw sector reads. PC-3000 Flash includes profiles for Samsung, Toshiba/Kioxia, SK Hynix, and Micron eMMC controllers.
NAND Wear-Out
eMMC chips in Chromebooks and budget laptops use TLC NAND rated for 1,500 to 3,000 program/erase cycles per block. Devices that run for 3 to 5 years with regular use can exhaust the NAND's write endurance. Symptoms include progressively slower write speeds, intermittent read errors, and eventually the device failing to boot. The eMMC controller remaps bad blocks until the spare block pool runs out.
Recovery approach: ISP access first. If the controller still responds, image the chip with multiple read passes, skipping and retrying failed sectors. If the controller is non-responsive due to exhausted remap tables, proceed with chip-off: desolder the BGA package, read the raw NAND with PC-3000 Flash, and reconstruct the data using the controller-specific ECC algorithm.
Solder Joint Fracture
The 153/169 BGA solder balls connecting the eMMC to the motherboard can fracture from repeated thermal cycling, flex stress from drops, or manufacturing defects. A single cracked solder ball on a data line causes intermittent or permanent communication failure. The device may work inconsistently (booting sometimes but not others) before failing completely.
Recovery approach: Attempt ISP via test points first (bypasses the BGA connection issue if the ISP pads connect upstream of the fracture). If ISP fails, desolder the eMMC chip, reball it with fresh solder balls, and either mount it on a test board with a working MMC interface or read the NAND directly via chip-off.
Host Board Failure
The most common reason for eMMC recovery: the host device's motherboard dies from liquid damage, a shorted power rail, or a failed CPU/SoC, but the eMMC chip itself is fine. The user cannot access their data because the eMMC has no removable connector. On a laptop with a standard SSD, you would pull the SSD and plug it into another machine. With eMMC, that is not possible.
Recovery approach: ISP is the first choice. We locate the eMMC test points on the board's PCB (CLK, CMD, DAT0-DAT7, VCC, VCCQ, GND) and connect a programmer that speaks the MMC protocol. The chip responds to standard MMC read commands because its controller is healthy. We image the full eMMC, then mount the partition and extract the user's files.
eMMC Recovery Pricing
eMMC recovery uses the same pricing tiers as SSD and flash media recovery. The cost depends on the failure type and recovery method, not the device brand or eMMC capacity. No diagnostic fee.
| Service Tier | Price | Description |
|---|---|---|
| Simple CopyLow complexity | $200 | Your drive works, you just need the data moved off it Functional drive; data transfer to new media Rush available: +$100 |
| File System RecoveryLow complexity | From $250 | Your drive isn't showing up, but it's not physically damaged File system corruption. Visible to recovery software but not to OS Starting price; final depends on complexity |
| Circuit Board RepairMedium complexity – PC-3000 required | $600–$900 | Your drive won't power on or has shorted components PCB issues: failed voltage regulators, dead PMICs, shorted capacitors May require a donor drive (additional cost) |
| Firmware RecoveryMedium complexity – PC-3000 required | $900–$1,200 | Your drive is detected but shows the wrong name, wrong size, or no data Firmware corruption: ROM, modules, or system files corrupted Price depends on extent of bad areas in NAND |
| Advanced Board RebuildHigh complexity – precision microsoldering and BGA rework | $1,200–$1,500 | Your drive's circuit board is severely damaged and requires advanced micro-soldering Advanced component repair. Micro-soldering to revive native logic board or utilize specialized vendor protocols 50% deposit required upfront; donor drive cost additional |
Hardware Repair vs. Software Locks
Our "no data, no fee" policy applies to hardware recovery. We do not bill for unsuccessful physical repairs. If we replace a hard drive read/write head assembly or repair a liquid-damaged logic board to a bootable state, the hardware repair is complete and standard rates apply. If data remains inaccessible due to user-configured software locks, a forgotten passcode, or a remote wipe command, the physical repair is still billable. We cannot bypass user encryption or activation locks.
All tiers: Free evaluation and firm quote before any paid work. No data, no fee on all tiers (advanced board rebuild requires a 50% deposit because donor parts are consumed in the attempt).
Target drive: The destination drive we copy recovered data onto. You can supply your own or we provide one at cost. All prices are plus applicable tax.
Data Recovery Standards & Verification
Our Austin lab operates on a transparency-first model. We use industry-standard recovery tools, including PC-3000 and DeepSpar, combined with strict environmental controls to make sure your hard drive is handled safely and properly. This approach allows us to serve clients nationwide with consistent technical standards.
Open-drive work is performed in a ULPA-filtered laminar-flow bench, validated to 0.02 µm particle count, verified using TSI P-Trak instrumentation.
Transparent History
Serving clients nationwide via mail-in service since 2008. Our lead engineer holds PC-3000 and HEX Akademia certifications for hard drive firmware repair and mechanical recovery.
Media Coverage
Our repair work has been covered by The Wall Street Journal and Business Insider, with CBC News reporting on our pricing transparency. Louis Rossmann has testified in Right to Repair hearings in multiple states and founded the Repair Preservation Group.
Aligned Incentives
Our "No Data, No Charge" policy means we assume the risk of the recovery attempt, not the client.
Technical Oversight
Louis Rossmann
Louis Rossmann's well trained staff review our lab protocols to ensure technical accuracy and honest service. Since 2008, his focus has been on clear technical communication and accurate diagnostics rather than sales-driven explanations.
We believe in proving standards rather than just stating them. We use TSI P-Trak instrumentation to verify that clean-air benchmarks are met before any drive is opened.
See our clean bench validation data and particle test videoTechnical Recovery Workflow
ISP (In-System Programming) Recovery
ISP is the preferred recovery method for eMMC because it avoids desoldering the chip. Every eMMC-equipped board has test points or pads that connect directly to the eMMC chip's signal lines: CLK (clock), CMD (command), DAT0 through DAT7 (data bus), VCC (3.3V core power), VCCQ (1.8V or 3.3V I/O power), and GND. We identify these test points using board schematics, boardview files, or by tracing the signal routes from the eMMC chip pads.
An ISP adapter connects to these test points with fine-pitch probes or soldered fly wires. The adapter provides clean, regulated power to the eMMC chip (bypassing the dead host board's power circuitry) and sends standard MMC read commands. If the eMMC controller responds, we image the chip sector by sector. PC-3000 Flash handles the ISP session, managing read retries, timeout handling, and partition mapping.
Chip-Off BGA Recovery
When ISP fails (controller locked, damaged test points, or no accessible ISP pads), we desolder the BGA eMMC package. The board is preheated to 150°C to reduce thermal stress, then a focused hot-air nozzle at 260-280°C melts the solder balls. The chip is lifted and cleaned of residual solder. We place the chip in a BGA-to-socket adapter (the socket matches the 153-ball or 169-ball pinout of the specific eMMC package) and connect it to PC-3000 Flash.
PC-3000 Flash communicates with the eMMC controller using the MMC protocol. If the controller responds, we image normally. If the controller is dead, PC-3000 Flash reads the raw NAND pages directly, bypassing the controller. Raw NAND reading requires identifying the eMMC manufacturer and controller model to apply the correct ECC algorithm (BCH or LDPC) and XOR descrambling pattern. After descrambling, we reassemble the logical block layout and reconstruct the file system.
Common eMMC Controllers
Each eMMC manufacturer uses a proprietary controller with different firmware, ECC configurations, and FTL (Flash Translation Layer) implementations. PC-3000 Flash includes recovery profiles for the major eMMC controller families:
- Samsung (KLMAG, KLMBG, KLMCG series): Found in Samsung Chromebooks, Galaxy tablets, and many OEM devices. Samsung eMMC chips use proprietary controller silicon with LDPC ECC. ISP recovery is well-supported; Samsung's controller responds reliably to standard MMC commands via ISP.
- Toshiba/Kioxia (THGBMHG, THGBMDG series): Common in Acer and HP Chromebooks, budget Windows laptops. The Toshiba controller uses BCH ECC on older models and LDPC on newer ones. Firmware lockouts on Toshiba eMMC chips can sometimes be resolved through vendor-specific MMC commands accessible via ISP.
- SK Hynix (H26M, H26T series): Used in Lenovo Chromebooks, Amazon Fire tablets, and various embedded devices. Hynix eMMC controllers have a known issue where power loss during garbage collection leaves the FTL in an inconsistent state, causing the chip to enter a boot-loop. ISP access with vendor commands can often force the controller to rebuild its tables.
- Micron (MTFC series): Found in ASUS Chromebooks and industrial IoT devices. Micron eMMC chips use a controller similar to their SSD line. ECC and FTL profiles in PC-3000 Flash handle Micron eMMC chip-off recovery.
File System and Encryption Handling
The file system on the eMMC partition varies by device type:
- Chromebooks: ChromeOS partitions the eMMC using GPT with a ChromeOS kernel partition, a root filesystem (squashfs, read-only), and a stateful partition (ext4) that stores user data. User data on the stateful partition is encrypted with dm-crypt, keyed to the user's Google account credentials. Recovery of the raw image is possible; decryption requires the user's password.
- Windows devices: NTFS or FAT32 on a GPT or MBR layout. Budget Windows laptops with eMMC do not typically enable BitLocker by default, so the data is usually accessible after imaging. Windows 11 24H2 devices may have automatic Device Encryption enabled; check our Windows 11 encryption recovery page.
- Android tablets: Android uses ext4 on the userdata partition with file-based encryption (FBE) since Android 7. Decryption requires the device's lock screen credentials (PIN, pattern, or password).
- Embedded/IoT: Embedded Linux systems on eMMC typically use ext4, F2FS, squashfs, or raw block storage. We deliver a sector-level image of the eMMC so the client can mount it in their development environment.
What to Do When Your eMMC Device Fails
If your Chromebook, tablet, or embedded device stops booting and your data is on the internal eMMC storage, follow these steps:
- Stop powering the device. Do not repeatedly force-restart or attempt to reflash firmware. Each power cycle risks further corruption to the eMMC controller's state tables.
- Do not attempt a factory reset. A factory reset on a Chromebook or Android tablet formats the user data partition on the eMMC. If the device is still partially responsive, a factory reset will destroy the data you are trying to save.
- Note the device model and symptoms. Tell us the exact device model (e.g., "Acer Chromebook 311 CB311-9H"), what happened before the failure (liquid spill, power surge, OS update), and what the device does now (dead, boot loop, error screen).
- Ship the entire device. eMMC recovery requires access to the motherboard for ISP. Send the complete device (not just the storage chip) via our mail-in process.
What NOT to Do
- ✗Do not factory reset or powerwash the device
- ✗Do not attempt to reflash firmware from recovery mode
- ✗Do not open the device and attempt to desolder the eMMC yourself
- ✗Do not apply heat (hair dryer, heat gun) to "fix" solder joints
- ✓Power off the device and ship it to us for ISP or chip-off evaluation
eMMC Data Recovery: Common Questions
What is eMMC and how is it different from an SSD?
Can you recover data from a dead Chromebook?
What is ISP recovery for eMMC?
How much does eMMC data recovery cost?
Is data on a Chromebook eMMC encrypted?
Can eMMC chips be replaced after data recovery?
What is the difference between eMMC and eUFS?
How long does eMMC recovery take?
Need Recovery for a Removable SSD or Flash Card?
eMMC is soldered to the board and requires ISP or chip-off access. If your device has a removable M.2 SSD, SD card, or USB drive, see our dedicated SSD recovery, SD card recovery, or monolithic flash recovery pages.
Need Recovery for Other Devices?
Dead Chromebook recovery with board repair and eMMC ISP
NVMe, SATA, and M.2 solid state drive recovery
Soldered SSD recovery for T2 and Apple Silicon Macs
Board-level NAND recovery for iPhones and iPads
MicroSD, SDHC, and SDXC card recovery
MicroSD wear-out and eMMC chip-off for vehicle cameras
Monolithic NAND chip pinout and recovery database
Complete service catalog
eMMC device not booting?
Free evaluation. No data, no charge. Ship the entire device; we handle the rest.