SSD Controller Architecture
Innogrit SSD Data Recovery
Innogrit's Rainier family covers three NVMe controller generations: the IG5216 (Shasta+, Gen3), IG5220 (RainierQX, Gen4 DRAM-less), & IG5236 (Rainier, Gen4 with DDR4 DRAM). The IG5236 is the most common failure we see; its firmware panics under sustained mixed I/O, dropping the drive's identity to "MN-5236" with a 2.1GB diagnostic capacity. All three controllers use AES-256 hardware encryption, so chip-off isn't an option. NVMe recovery starts at From $200. No diagnostic fee.
Which Innogrit Controller Is in Your SSD?
Innogrit ships three NVMe controller families. Two are DRAM-less (IG5216, IG5220), caching the Flash Translation Layer in host RAM via Host Memory Buffer. The IG5236 has dedicated DDR4 DRAM & 8 NAND channels. All three use quad-core or tri-core ARM Cortex-R5 processors on TSMC 12nm FinFET silicon.
| Controller | Interface | DRAM | Common Drives | Failure Signature | PC-3000 Support |
|---|---|---|---|---|---|
| IG5216 (Shasta+) | NVMe Gen3 x4 | No (HMB) | HP EX900 Plus, VisionTek DLX3 | FTL corruption, HMB loss after power cut | InnoGrit Utility (Universal mode) |
| IG5220 (RainierQX) | NVMe Gen4 x4 | No (HMB) | TeamGroup G50, ADATA Atom 50, VisionTek DLX4 | FTL corruption, HMB loss, silicon descriptor | InnoGrit Utility (Techno Mode) |
| IG5236 (Rainier) | NVMe Gen4 x4 | Yes (DDR4) | ADATA XPG Gammix S70 Blade, HP FX900 Pro, Acer Predator GM7000 | MN-5236 firmware panic, 2.1GB capacity, ADATA Toolbox 60% bug | Extended InnoGrit Utility |
BOM roulette warning: some drives labeled with one controller ship with different silicon between production runs. The Netac NV7000 has been found with both IG5236 (early batches) & Phison E18 (later batches). The recovery engineer must physically inspect the PCB to identify the actual controller before selecting a PC-3000 profile.
How Do Innogrit SSDs Fail?
Innogrit SSD failures split into three categories: firmware corruption, controller death from electrical damage, & NAND degradation from cell wear. Firmware corruption is the most common. The IG5236's aggressive multi-core write parallelism makes its firmware brittle under sustained mixed workloads; instead of degrading gracefully, it panic-locks & drops to the MN-5236 diagnostic state.
Firmware Corruption
The drive shows up in BIOS as "MN-5236" (for IG5236 drives) instead of the consumer brand name. It may report 2.1GB, 2MB, or 0 bytes capacity. Your data is still in the NAND chips; the controller just can't read its own corrupted firmware modules to locate it. PC-3000 SSD's InnoGrit Utility bypasses the corruption through Technological Mode & provides direct NAND access. NVMe firmware recovery: $900–$1,200.
Controller Failure
A dead controller means the drive isn't detected at all: not on the PCIe bus, not in BIOS, not in Disk Management. The IG5236 generates sustained heat under Gen4 write loads. Budget drives (HP FX900 Pro, Patriot Viper VP4300) without heatsinks are vulnerable to PMIC burnout & BGA solder micro-fractures from thermal cycling. Recovery starts with FLIR thermal imaging to locate the failed component, then board-level repair with a Hakko FM-2032 microsoldering iron. NVMe board repair: $600–$900.
NAND Degradation
NAND flash cells have a finite write life. The IG5236 pairs with various TLC NAND from Micron & SK Hynix. As cells wear, bit-flip rates climb until the controller's LDPC error correction can't keep up. The drive slows progressively, then locks into read-only mode or stops responding. PC-3000 SSD can apply voltage threshold shifts during extraction to pull data from degraded cells that the controller has abandoned.
When Recovery Software Works (and When It Doesn't)
Recovery software like Disk Drill, EaseUS, PhotoRec, & R-Studio works when the SSD is physically healthy but has a logical problem: accidental deletion with TRIM disabled, a corrupted partition table, or a formatted volume. These tools talk to a working controller through your operating system.
That changes when the controller is dead or the firmware is corrupted. Software can't communicate with a drive that won't power on or shows as MN-5236 in BIOS. At that point, you need a lab with PC-3000 SSD & board-level repair capability. On modern SSDs with TRIM enabled (the default on Windows 7+ & macOS 10.6.8+), deleted files are gone within seconds to minutes. The OS sends a TRIM command telling the controller which blocks are free. The controller's garbage collection process erases those NAND pages. No software & no lab can recover data from erased NAND cells.
How Much Does Innogrit SSD Recovery Cost?
All Innogrit controllers (IG5216, IG5220, IG5236) are NVMe. Cost depends on failure severity, not the controller model. No diagnostic fee. No data, no recovery fee. Full SSD recovery cost breakdown. +$100 rush fee to move to the front of the queue.
NVMe SSD Recovery (IG5216, IG5220, IG5236)
Simple Copy
Low complexityYour NVMe drive works, you just need the data moved off it
$200
3-5 business days
Functional drive; data transfer to new media
Rush available: +$100
File System Recovery
Low complexityYour NVMe drive isn't showing up, but it's not physically damaged
From $250
2-4 weeks
File system corruption. Visible to recovery software but not to OS
Starting price; final depends on complexity
Circuit Board Repair
Medium complexityYour NVMe drive won't power on or has shorted components
$600–$900
3-6 weeks
PCB issues: failed voltage regulators, dead PMICs, shorted capacitors
May require a donor drive (additional cost)
Firmware Recovery
Medium complexityMost CommonYour NVMe drive is detected but shows the wrong name, wrong size, or no data
$900–$1,200
3-6 weeks
Firmware corruption: ROM, modules, or system files corrupted
Price depends on extent of bad areas in NAND
PCB / NAND Swap
High complexityYour NVMe drive's circuit board is severely damaged and requires NAND chip transplant to a donor PCB
$1,200–$2,500
4-8 weeks
NAND swap onto donor PCB. Precision microsoldering and BGA rework required
50% deposit required; donor drive cost additional
50% deposit required
Hardware Repair vs. Software Locks
Our "no data, no fee" policy applies to hardware recovery. We do not bill for unsuccessful physical repairs. If we replace a hard drive read/write head assembly or repair a liquid-damaged logic board to a bootable state, the hardware repair is complete and standard rates apply. If data remains inaccessible due to user-configured software locks, a forgotten passcode, or a remote wipe command, the physical repair is still billable. We cannot bypass user encryption or activation locks.
No data, no fee. Free evaluation and firm quote before any paid work. Full guarantee details. NAND swap requires a 50% deposit because donor parts are consumed in the attempt.
Rush fee: +$100 rush fee to move to the front of the queue.
Donor drives: A donor drive is a matching SSD used for its circuit board. Typical donor cost: $40–$100 for common models, $150–$300 for discontinued or rare controllers.
Target drive: The destination drive we copy recovered data onto. You can supply your own or we provide one at cost plus a small markup. All prices are plus applicable tax.
A donor drive is a matching SSD used for its circuit board. Typical donor cost: $40–$100 for common models, $150–$300 for discontinued or rare controllers.
Innogrit Firmware Architecture: Marvell Pedigree, Aggressive Parallelism
Innogrit was founded in October 2016 by Dr. Zining Wu, who spent 17 years as CTO at Marvell Technology & holds over 200 patents in storage controller design. The company is headquartered in San Jose, California, with additional offices in Beijing & Shanghai. Innogrit is a fabless IC designer; TSMC manufactures the silicon on 12nm FinFET.
IG5236 Rainier: DRAM-Equipped Flagship
The IG5236 is a PCIe 4.0 x4 NVMe 1.4 controller with quad-core ARM Cortex-R5, 8 NAND channels, & a dedicated DDR4 DRAM cache. It reads up to 7,400 MB/s, writes up to 6,800 MB/s, & reaches 1.2M IOPS random. The onboard DRAM stores the active FTL, reducing vulnerability to power loss compared to DRAM-less controllers. The FTL backup flushes periodically to reserved NAND service area blocks.
The IG5236's firmware prioritizes sequential throughput through aggressive multi-core parallelism. All four Cortex-R5 cores manage concurrent NAND channel operations. This architecture delivers high benchmark numbers but creates a brittleness problem: under sustained mixed I/O workloads (simultaneous random reads, sequential writes, & garbage collection), a buffer overflow in the firmware state machine causes a panic lock. The controller doesn't degrade gracefully; it stops.
IG5220 RainierQX & IG5216 Shasta+: DRAM-less Budget Controllers
The IG5220 (Gen4 x4, tri-core ARM Cortex-R5, 4 channels) & IG5216 (Gen3 x4, 4 channels) are DRAM-less. Both cache the Flash Translation Layer in host RAM through NVMe Host Memory Buffer. The IG5220 reads up to 5,200 MB/s & writes up to 4,775 MB/s. The IG5216 maxes out at 3,400 MB/s read & 3,000 MB/s write with 500K IOPS random.
The HMB dependency creates the same vulnerability seen in Silicon Motion & Maxio DRAM-less NVMe controllers: a power cut severs the PCIe link, the in-flight FTL update in host RAM never commits to NAND, and the controller boots with a corrupted mapping table. The drive reports its silicon descriptor or 0 bytes & won't mount.
- Flash Translation Layer (FTL)
- The mapping table that converts logical block addresses (what your operating system requests) to physical NAND page locations (where data is stored on the flash chips). Every SSD maintains an FTL. When it corrupts, the controller can't locate any data even though the NAND still holds it.
- AES-256 Hardware Encryption
- All three Innogrit NVMe controllers encrypt data written to NAND using AES-256. The encryption key is generated during manufacturing & stored in hardware fuses on the controller die. This key never leaves the silicon. If the controller dies, the key dies with it, & the NAND contents are unreadable ciphertext. Chip-off recovery is not viable on any Innogrit SSD.
MN-5236 Firmware Panic: Buffer Overflow Under Mixed I/O
The most common IG5236 failure mode is a firmware panic that causes the drive to drop its consumer identity & report as "MN-5236" with 2.1GB or 2MB capacity. The NAND data is intact. The controller's firmware state machine has entered an irrecoverable error state that consumer tools can't clear.
Root Cause: Defective NAND Page Handling
The IG5236's quad-core Cortex-R5 firmware manages concurrent operations across 8 NAND channels. Under sustained mixed I/O (simultaneous random reads, sequential writes, & background garbage collection), the controller encounters a defective NAND page during a program operation. The error handler for that defective page triggers a buffer overflow in the firmware's internal command queue.
The overflow corrupts the module tables stored in the controller's working memory. The firmware detects the corruption, aborts all pending operations, & drops to a factory diagnostic state. The drive reverts to its silicon descriptor ("MN-5236") and reports a 2.1GB diagnostic capacity instead of the drive's real size. This panic is permanent; power cycling doesn't clear it. The corrupted module tables must be bypassed through PC-3000 SSD's InnoGrit Utility.
ADATA SSD Toolbox "60% Bug"
A specific trigger for the MN-5236 panic is the ADATA SSD Toolbox Quick Diagnostic Scan. The scan generates a pattern of mixed I/O that hits the IG5236's buffer overflow vulnerability. Users report the scan freezes at 60% progress, then the drive enters MN-5236 state permanently.
The 60% freeze point isn't arbitrary. At that stage, the Toolbox transitions from sequential read verification to random mixed I/O stress testing. The IG5236's firmware encounters the defective-page condition during this transition, triggers the overflow, & locks. The ADATA XPG Gammix S70 Blade is the most frequently affected drive. If your drive shows MN-5236 after running the ADATA Toolbox, don't run the Toolbox again or attempt firmware reflashing. Both actions risk overwriting the existing NAND data structure.
Power Loss Recovery Loop
After an unclean shutdown (power failure, forced restart, BSoD), the IG5236 enters a recovery routine that can take 30+ seconds. The controller attempts to reconcile its FTL state by scanning NAND metadata & verifying committed writes against the DRAM-cached mapping table stored in the reserved service area.
If the user interrupts this recovery routine by power cycling again before it completes, the controller must restart the reconciliation from scratch with an additional layer of corruption. Repeated power cycling compounds the FTL damage. Each interrupted recovery attempt adds another layer of corruption until the controller enters permanent firmware panic. The drive becomes undetectable on the PCIe bus.
ROM-Mode Entry & PC-3000 Workflows for Innogrit Controllers
When an Innogrit controller enters firmware panic, it won't respond to standard NVMe read commands. The recovery engineer forces the controller into Technological Mode (Safe Mode) through ROM pin shorting, then uses PC-3000 SSD's InnoGrit Utility to bypass the corrupted firmware & extract data directly from NAND.
Technological Mode Entry via ROM Pin Shorting
- Connect the NVMe SSD to PC-3000 Portable III via M.2 adapter on Port 0. Confirm the drive is in firmware panic state (PCIe link trains but NVMe initialization fails, or drive reports MN-5236 descriptor).
- Locate the ROM-mode shorting points on the M.2 PCB. On IG5236 boards, these are test pads near the controller BGA package. Bridge the designated pins with tweezers before applying power.
- The controller boots into Technological Mode using only its internal BootROM, ignoring the corrupted firmware & FTL data stored in NAND. It identifies with a generic descriptor.
- PC-3000 SSD recognizes the controller in Technological Mode. Remove the short when prompted by the software.
- PC-3000 injects a custom microcode loader into the controller's SRAM. The loader contains NAND access drivers & AES-256 decryption parameters matched to the specific controller/NAND combination. Background maintenance (wear leveling, garbage collection, TRIM) is disabled in the loader.
FTL Reconstruction from NAND Metadata
- NAND page scan. The InnoGrit Utility reads every physical page across all NAND chips (8 channels on IG5236, 4 on IG5220/IG5216). Each page's spare area contains an LBA stamp, a sequence number, & an ECC checksum.
- Sequence number sorting. Multiple physical pages may claim the same logical block address due to wear leveling & garbage collection rewrites. The page with the highest sequence number holds the most recent valid data. PC-3000 selects the latest copy for each LBA.
- AES-256 decryption. When the original controller is alive in Technological Mode, PC-3000 reads the Media Encryption Key from the controller's hardware fuses & decrypts NAND pages during extraction. This is transparent to the recovery process.
- Virtual translator build. PC-3000 constructs a new logical volume from the sorted & decrypted pages, bypassing the dead FTL entirely. The result is a mountable image with the original file system structure intact.
Equipment Used
- PC-3000 SSD
- PC-3000 Portable III
- InnoGrit Extended Utility
- Hakko FM-2032 microsoldering iron
- FLIR thermal camera
- Atten 862 hot air rework station
- Zhuo Mao BGA rework station
Board-Level Repair: When the Controller Is Dead
ROM pin shorting & Technological Mode entry require a functioning controller. If the IG5236 controller IC is electrically dead (PMIC failure, shorted capacitor, BGA fracture from thermal stress), PC-3000 reports "no device detected." The recovery path starts with hardware repair, not firmware bypass.
The recovery engineer uses a FLIR thermal camera to locate the failed component. A shorted PMIC shows as a thermal hotspot before the drive reaches operating temperature. A BGA micro-fracture shows as a cold spot against the controller's normal heat signature. Component-level replacement uses a Hakko FM-2032 on an FM-203 base station for fine-pitch SMD work & a Zhuo Mao BGA rework station for controller reflow.
When the original controller boots again, the AES-256 encryption keys are intact & the data is accessible through PC-3000. Board repair isn't a separate service from data recovery on encrypted NVMe SSDs; for Innogrit drives, it IS data recovery. NVMe board repair: $600–$900.
Firmware Panic vs Controller Death: How to Tell
- Firmware Panic (Recoverable via PC-3000)
- The PCIe link trains successfully. The drive may briefly identify as MN-5236 with 2.1GB capacity, or it may complete link negotiation but fail NVMe initialization. PC-3000 Portable III detects link activity & flags a firmware-level failure. Technological Mode entry through ROM pin shorting bypasses the panic. NVMe firmware recovery: $900–$1,200.
- Controller Death (Board Repair Required)
- No PCIe link training occurs. PC-3000 Portable III reports "no device detected." The drive may draw abnormal current, or the controller IC runs hot at idle (visible on FLIR before applying full operating power). Common causes: PMIC failure from thermal stress, shorted decoupling capacitors, or ESD damage. Board-level microsoldering must restore electrical function before firmware recovery can begin. NVMe board repair: $600–$900.
IG5236 Thermal Stress: Gen4 Heat in Budget Enclosures
The IG5236's quad-core ARM Cortex-R5 on 12nm FinFET draws sustained current at Gen4 speeds. Rated for up to 7,400 MB/s sequential read, the controller generates enough heat during continuous writes to stress BGA solder joints & PMIC components. Budget drives that ship without heatsinks are the primary failure population.
Repeated thermal cycling (high temperature during sustained writes, ambient temperature at idle) causes micro-fractures in the BGA solder balls connecting the IG5236 to the M.2 PCB. These fractures are invisible to the naked eye. The drive may work intermittently for weeks before failing permanently. FLIR thermal imaging at our Austin, TX lab reveals the fractured joints as cold spots against the controller's normal heat signature.
PMIC burnout is the second thermal failure mode. The PMIC (power management IC) regulates voltage to the controller & NAND packages. When sustained heat exceeds its thermal limits, it shorts. A shorted PMIC draws excess current and prevents the controller from booting. FLIR shows the failed PMIC as a thermal hotspot at idle. Repair requires desoldering the failed PMIC with an Atten 862 hot air rework station & replacing it with a Hakko FM-2032 on an FM-203 base station.
Why Board Repair IS Data Recovery for Encrypted SSDs
Most data recovery labs outsource board-level failures or declare them unrecoverable. We don't. We locate the failed component using FLIR thermal imaging, replace the shorted PMIC or damaged capacitor with a Hakko FM-2032, & bring the original controller back to life. When the controller boots, the AES-256 encryption keys are intact & your data is accessible through PC-3000.
Board repair isn't a separate service from data recovery for Innogrit SSDs. The encryption keys are fused to the controller silicon. If the controller is dead, chip-off yields only ciphertext. Reviving the original controller is the only recovery path. NVMe board repair: $600–$900.
How Does Innogrit Recovery Differ from Silicon Motion & Phison?
Innogrit, Silicon Motion, & Phison represent three different firmware design philosophies. Each produces different failure modes & requires different PC-3000 recovery approaches. The choice of controller determines the recovery timeline & complexity.
| Attribute | Innogrit IG5236 | Silicon Motion SM2262EN | Phison E18 |
|---|---|---|---|
| CPU Cores | 4x Cortex-R5 | 2x Cortex-R5 | 3x Cortex-R5 |
| NAND Channels | 8 | 8 | 8 |
| DRAM | DDR4 | DDR4 | DDR4 |
| Process Node | 12nm FinFET | 28nm | 12nm |
| Encryption | AES-256 (fused) | AES-256 (fused) | AES-256 + XOR scrambling |
| Primary Failure Mode | MN-5236 firmware panic | ROM mode, 0GB capacity | BSY state, silicon descriptor |
| Firmware Behavior Under Stress | Panic-locks (brittle) | Graceful degradation | Aggressive throttling |
| PC-3000 Utility Maturity | Extended (evolving) | Full Active Utility | Repair-only (limited) |
Silicon Motion controllers (SM2258XT, SM2262EN) have been on the market since 2016 & have mature PC-3000 Active Utility support with documented loader databases. Phison E12 has full Active Utility support; the E18 is limited to repair-only mode with no FTL reconstruction. Innogrit is a newer player; ACELab's PC-3000 SSD Extended InnoGrit Utility is still evolving, with some Technological Mode operations under active development.
The firmware design philosophy matters for recovery. Silicon Motion controllers tend to degrade gracefully, entering Keep BSY or ROM mode where the controller remains electrically responsive. Innogrit's IG5236 panic-locks under the same conditions, sometimes requiring more aggressive Technological Mode entry sequences. This doesn't change the recovery outcome; it changes the time required to stabilize the controller before data extraction begins.
See also: Silicon Motion architecture | Maxio architecture
Innogrit Drive-to-Controller Reference
This table maps verified US-market drives to their Innogrit controllers. All Innogrit controllers use AES-256 hardware encryption with keys fused to the controller silicon. Chip-off recovery is not viable on any drive listed here.
| Drive | Controller | NAND | Interface |
|---|---|---|---|
| ADATA XPG Gammix S70 Blade | IG5236 (Rainier) | Micron / SK Hynix TLC | Gen4 |
| HP FX900 Pro | IG5236 (Rainier) | Various TLC | Gen4 |
| Acer Predator GM7000 | IG5236 (Rainier) | Various TLC | Gen4 |
| Mushkin Redline Vortex | IG5236 (Rainier) | Various TLC | Gen4 |
| Patriot Viper VP4300 | IG5236 (Rainier) | Various TLC | Gen4 |
| Netac NV7000 (early revisions) | IG5236 (Rainier) | Various TLC | Gen4 |
| TeamGroup G50 | IG5220 (RainierQX) | TLC | Gen4 |
| ADATA Atom 50 | IG5220 (RainierQX) | TLC | Gen4 |
| VisionTek DLX4 | IG5220 (RainierQX) | TLC | Gen4 |
| HP EX900 Plus | IG5216 (Shasta+) | TLC | Gen3 |
| VisionTek DLX3 | IG5216 (Shasta+) | TLC | Gen3 |
BOM roulette applies. The Netac NV7000 has been found with both IG5236 (early revisions) & Phison E18 (later batches). Sabrent Rocket 4 Plus, TeamGroup Cardea A440 Pro, & Inland Performance Plus use Phison E18, NOT Innogrit. The recovery engineer must physically inspect the PCB to confirm the controller before selecting a PC-3000 profile.
Innogrit SSD Recovery FAQ
How much does Innogrit SSD data recovery cost?
What does it mean when my SSD shows up as MN-5236 with 2.1GB capacity?
Did the ADATA SSD Toolbox kill my Innogrit SSD?
Can recovery software fix a dead Innogrit SSD?
Can chip-off recovery work on Innogrit NVMe SSDs?
Can a power outage permanently damage an Innogrit SSD?
What is the difference between the IG5236 and IG5220 for recovery?
My Innogrit SSD takes 30+ seconds to boot after a crash. Should I keep restarting?
Need Recovery for Other Devices?
M.2, U.2, PCIe NVMe drives
Mechanical HDD recovery
Soldered SSD recovery
SSD array recovery
Similar NAND flash
View complete catalog
All SSD controllers we recover: Silicon Motion, Phison, Samsung, Marvell, Maxio, Realtek, InnoGrit
Innogrit SSD showing MN-5236, stuck in firmware panic, or not detected?
Free evaluation. NVMe recovery from From $200. No data, no fee.