I soldered leads to the 3.3V, GND, TX and RX pads were the daughter board connects to the main board. I also soldered a lead to IO0 so I could ground it while powering it up to get it into flash mode.
The outer case is connected to the inner case with a bunch of tabs around the edge. I pried them open with a small screwdriver. The outer case got pretty chewed up in the process.
Serial TX/RX pins can be accessed without any desoldering by scratching off the solder mask on the via pads adjacent to the TX/RX pins. Vcc/Gnd is accessible from the bypass capacitor.