Exploit: Data recovery on Microsoft Surface pro 5 2017 (November 2019)

Recently, we received a request for data recovery on a tablet.

It was a Microsoft Surface Pro 2017 (model 1796 to be verified) with a capacity of 250GB. The failure occurred following a fall to the ground from 3m. Our client is very keen to recover his professional data. As soon as we received the equipment, we were able to see the extent of the damage: the screen is completely damaged and the chassis is twisted.

Initially we were considering to repair the card, but after some tests we found that the torsion on the card made it irreparable. Faced with a problem, we did some research on the Internet and contacted our suppliers and colleagues abroad, but realised that no one had a solution. The NAND is a  BGA KUS02020203M-B000 and the containing data is welded to the motherboard. It is a POP component (Package on package). Desoldering is complicated on this type of component since there is one component welded on another.

It was not a standard EMMC like the other surfaces we have already treated. We only had one solution left: to develop a proprietary transfer card. Our experts made a first attempt but it proved unsuccessful, because the successful creation of the image could not be established. One of the welds didn’t hold.

The second attempt at copying allowed us to obtain a complete clone of its content. This success is linked to the tenacity of our research and development department.

Congratulations to them 😉

The next challenge is already here: we have just received the same tablet with a toshiba chip THNSN0256GTYA … To be continued