iPhone NAND Recovery

iPhone Stuck in DFU: NAND & Storage Recovery

DFU mode means the CPU is alive but cannot find an operating system to load. In most of these phones the NAND storage chip still holds your photos, messages, and apps. The phone just can't talk to that chip anymore. We fix the communication path at the board level so the phone boots and your data becomes accessible again.

Get a Free Evaluation iPhone Recovery Overview

Author

Written by

Louis Rossmann

Founder & Chief Technician

Updated February 2026

10 min read

What DFU Mode Means for Your Data

DFU stands for Device Firmware Upgrade. When an iPhone enters DFU mode, the CPU powers on, but it can't find a valid operating system on the NAND storage chip. The phone drops into DFU automatically as a fallback state. iTunes or Finder detects the device, but the screen stays black.

On most DFU phones, the NAND chip itself is fine. All photos, messages, contacts, and app data remain on the chip. The phone simply cannot read the data because something broke the communication path between the CPU and the storage.

DFU mode isn't the same thing as a dead phone that will not turn on, or a boot loop, where the phone finds the OS but crashes during startup. Each presentation points to a different failure and a different repair path.

PP3V0_NAND Power Rail Diagnostics

PP3V0_NAND is a NAND power rail on the iPhone 6 and iPhone 8. Without this rail, the NAND has no power and the CPU cannot read or write to storage.

On iPhone 8, a shorted PP3V0_NAND causes the PMIC (power management IC) to heat up. The phone draws too much current and won't boot at all.

Additional NAND Power Rails

On the iPhone 11, the NAND rails include PP2V63_NAND, PP1V8_NAND, and PP0V9_NAND. We test each one separately in diode mode.

Update vs. Restore: The Critical Distinction

Never restore a DFU phone that has important data. A restore erases all user data: photos, messages, contacts, app data, everything. This action is irreversible. If someone at a repair shop tells you to restore, and your data matters, stop and get a second opinion.

When the phone is in Recovery mode, iTunes and Finder give you two options: Update and Restore. In DFU mode, the only thing iTunes or Finder can do is restore it. Those two options aren't the same thing, and the difference is whether you keep your data.

Update reinstalls the iOS operating system while preserving all user data. Photos, messages, contacts, and apps remain on the device.
Restore wipes the device completely, then installs a fresh copy of iOS. All user data is permanently deleted.

If the phone is in Recovery mode and you care about the data, try Update first. If it's in DFU mode, 3uTools has a flashing mode it calls "Retain User's Data While Flashing". 3u's own documentation says that mode starts from DFU mode and updates iOS without losing user data.

If the update fails, the error code returned by iTunes is diagnostic information. Write down the error code before doing anything else.

If the update succeeds, the phone boots with all data present. If it fails, we diagnose from there. Either way, the data remains on the NAND because an update never erases it.

iTunes Error Codes During an Update or Restore

Error 9 / Error 35

These errors indicate the device disconnected during the restore or update process.

See our Error 4013 page if that's the code you got.

Other restore-error families have their own root causes; see Error 1110 and Error 14 for those specific failures.

NAND Programming and Compatibility

If the original NAND chip is dead, the replacement NAND has to be programmed with the phone's serial number, WiFi MAC address, and Bluetooth MAC address, or the phone won't activate. Without this programming step, iOS refuses to complete setup.

Tooling

NAND programming requires a compatible programmer for the specific iPhone model.

Donor Compatibility

Donor NAND compatibility depends on the NAND type and generation. Some iPhone models share the same BGA NAND package and can serve as donors for each other after reprogramming with the correct serial number and MAC addresses. Compatibility must be verified for each specific model pairing before attempting a swap.

We Don't Do CPU Swaps

The encryption pairing lives in the silicon, not in the fiberglass. The NAND is cryptographically married to the CPU that carries the Secure Enclave and to the board's secure-storage chip, a logic EEPROM on older models and a Secure Storage Component on newer ones. The board underneath is a carrier for those chips. That's why a NAND moved by itself onto another board can't be decrypted there.

When the original board can't be repaired, the trade's answer is a CPU Swap: the CPU, the NAND, and that secure-storage chip move together onto a donor board of the same model. We don't do CPU swaps, so a board that would need one isn't a job we take. What we do is reball the original NAND back onto the repaired original board.

NAND replacement does not recover existing data. The NAND is encrypted with keys held by the Secure Enclave on the original CPU. A new NAND chip starts empty. NAND replacement restores phone function for cases where the user has an iCloud backup. To get data off the original NAND, we repair the original board.

Why Chip-Off Recovery Does Not Work on iPhones

“Chip-off” recovery means pulling the NAND flash chip off the board and reading it with a standalone programmer. This technique works on older Android phones and USB flash drives where the storage is not encrypted or uses a known encryption key. It does not work on any iPhone with an A7 processor or newer (iPhone 5s and all later models).

Every iPhone since the 5s has a Secure Enclave coprocessor built into the main CPU die. The Secure Enclave generates and stores the hardware encryption keys that protect the NAND. These keys are unique to each individual CPU and are not extractable. The NAND data is encrypted in hardware with AES in XTS mode, AES-128-XTS on the A9 through A13 generations and AES-256-XTS on A14 and later, and the decryption key never leaves the Secure Enclave boundary.

If you desolder the NAND chip and read it on a programmer, you get encrypted data. Without the matching Secure Enclave (which lives on the original CPU), that data cannot be decrypted. There is no known method to extract Secure Enclave keys. Moving the NAND to a different logic board produces the same result: the new board has a different Secure Enclave with different keys, so the encrypted data is unreadable.

The same Secure Enclave constraint governs iPad and Apple Silicon Mac storage, which is why iPad data recovery and Apple Silicon Mac recovery follow the same rule: the original SoC must run the decryption, and there is no chip-off shortcut.

On an A7 or later iPhone, the path to the data is repairing the original logic board. The original CPU must be alive and able to boot far enough to process the Secure Enclave decryption. That's why you can't do iPhone data recovery without board-level microsoldering.

Our Diagnostic Process

Identify the presentation. DFU mode, Recovery mode, specific iTunes error code, or no power at all. Each starting point narrows the possible failures. A phone that will not turn on at all has different root causes than one sitting in DFU.
Check NAND power rails. Diode mode readings on PP3V0_NAND, PP0V9_NAND, and PP1V8_NAND (model-dependent). A shorted rail gets traced and repaired before proceeding.
Attempt an update, never a restore. If power rails are good, we connect to iTunes or 3uTools and attempt an iOS update. The result tells us whether NAND communication is restored or what remains broken.

Pricing

Pre-X iPhones (original iPhone through 8 Plus)$500

Face ID models (X and newer)$750

EvaluationFree

No data recoveredNo charge

Watch: iPhone Data Recovery from Dead Logic Board

Louis Rossmann walks through board-level diagnosis and repair of a dead iPhone, including DC power supply analysis and component-level fault isolation for data recovery.

More board-level walkthroughs: the full dead logic board recovery walkthrough and an iPhone 6s diode-mode diagnostics teardown.

Frequently Asked Questions

Can you recover data from a phone stuck in DFU?

In many cases, yes. The NAND storage chip usually still has all your data on it. We fix whatever cut the phone off from that chip. Then the phone boots and you can get to your data again.

iTunes says 'Update' but I'm afraid it will erase my data

Update does not erase data. Restore does. An iTunes update reinstalls the operating system while keeping your photos, messages, and apps intact.

What does Error 4014 mean?

Apple groups Error 4014 with errors 9, 4005, and 4013. Any of them can show up when the phone disconnects during an update, or when the computer loses its connection to the phone during a restore.

Someone already tried to restore my phone. Is the data gone?

If the restore completed successfully, yes. A restore erases all user data and reinstalls iOS from scratch.

How much does NAND recovery cost?

$500–$750 depending on model and failure type. Pre-X iPhones (original iPhone through 8 Plus) are $500. Face ID models (X and newer) are $750. Evaluation is free, and if we cannot recover your data, there is no charge.

Can you just move my NAND to another phone?

No. iPhone NAND is encrypted and paired to the original CPU's Secure Enclave. Moving the NAND chip to a different logic board makes the data unreadable. We repair the original board instead, fixing whatever broke the communication between CPU and NAND.

My iPhone board snapped in half. Is the data gone?

Not necessarily. The data lives on the chips, not on the board they sit on. The NAND is paired to the CPU and to the board's secure-storage chip, so the way back is repairing the original board, which lets the phone decrypt its own storage again. We don't do donor-board transplants, so a board that can't be repaired isn't a job we take. Your passcode is still required to unlock the data.

Data Recovery Standards & Verification

Our Austin lab operates on a transparency-first model. We use industry-standard recovery tools, including PC-3000 and DeepSpar, combined with strict environmental controls to maintain drive integrity. This approach allows us to serve clients nationwide with consistent technical standards.

Localized Clean Zone

Open-drive work is performed in a 0.02 micron ULPA-filtered laminar clean bench.

Transparent History

Serving clients nationwide via mail-in service since 2008. Our lead engineer holds PC-3000 and HEX Akademia certifications for hard drive firmware repair and mechanical recovery.

Media Coverage

Our repair work has been covered by The Wall Street Journal and Business Insider, with CBC News reporting on our pricing transparency. Louis Rossmann has testified in Right to Repair hearings in multiple states and founded the Repair Preservation Group.

Aligned Incentives

Our "No Data, No Charge" policy means we assume the risk of the recovery attempt, not the client.

Technical Oversight

Louis Rossmann

Our engineers review all lab protocols to maintain technical accuracy and honest service. Since 2008, his focus has been on clear technical communication and accurate diagnostics rather than sales-driven explanations.

We believe in showing the bench rather than just describing it. Open-drive work runs on a 0.02 micron ULPA-filtered laminar clean bench, and we filmed it.

See the particle counter test at the bench

No Data, No Fee

Guarantee

2.64M

Subscribers

4.9

1,837+ Google Reviews

Since 2008

Established

Repairs on Video

Full Transparency

As Featured In