Pepe is correct. You need to understand allot more then just fat32 if you want to successfully recover data from Nand chips. Maybe with Salvation tool it's a click button solution, but for more serious work you need to know how data is stored, you need to understand the controller, the Nand technology, the mix, etc...

and some of flash dump was encrypted. need to know how to decrypt the encrypted dump.

_________________
Спасибо
СУТИОНО / АПИНГ

There is no "point and click" solution here, You has to recognize a lot of things...like nonstandard page size and lot of transitions, to get correct file structure.

Unfortunately, I am afraid of future in this area. More and more monolithic tiny USB drives, Micro SD cards etc...what the gurus think about that...

What think? New challenge

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices

I have looked at some of these tools.

There are two main fields:

A. Nand-flash stick storage
B. SSD

They are radically different in recovery options and success rate, not to mention controller structure.


There are a number of issues with various tools:


1. They require the removal of the Nand-flash chip, so that there is no intervening controller.
2. They are expensive, you buy a base station, which is just basically a Nand-flash chip reader, then the "decode" modules which just act as a software version of the nand-flash usb controller interface.

3. The microcode in the nand-flash USB controllers is sometimes regularly updated by the suppliers, just because you have a particular controller model , does not mean you will recover your data intact, or even be able to recover some files intact.
Keep in mind that there is upward of 4 GB of data on these devices, all it requires is a single page to be mis-placed in a large file.

As regards Nand-flash recovery, it is not like HD recovery, unless you think at the same level as the data coming from the disk head, I.E the data from a given Nand flash page is often corrupted and requires ECC, reading a page multiple times can in some cases result in different data being returned, even with "good" flash chips.
The data is often NOT where it should logically be.
Data cannot be written out of order , I.E if data is written to page 5 in a block, you CANNOT go back and write pages 0-4 even if the area is unallocated, UNTIL there has been a block erase, which in turn requires all the old data from the block to be "re-allocated" to a new block and physically moved.

Generally you cannot write update a partial page.

Which means in any cycle you have multiple sets of data that is "identical", these are spread all over the damned device and dependent on the algorithms of a particular version of the controller chip.

This is important because it can result in data being scrambled to such an extent only the controller chip can find it all.
On top of this are "badly" behaved controller chips, which do not follow the rules , We won't mention any names (I.E chipsbank)

There are also a number of "backdoors" built into some controller chips.

finally , using FAT32 on Nand-flash is the kiss of death, but because it is windows everybody uses it.......

A nand flash sector(page) is generally 2112 bytes , see if you can spot the deliberate balls up here, when using windows......

_________________
Universal Declaration of Human Rights: Article 19

does anyone have a tutorial on using the soft center flash extractor? or have any steps like a-z from removing the chip to getting the end data? what methods or programs are used?

Its all on their website/forum

_________________
You don't have to backup all of your files, just the ones you want to keep.

Sorry to go off topic here, but would someone in the US who has purchased Flash Extractor please pm me. My bank is a small credit union and they seem to be unsure exactly how to do the wire transfer. Could you tell me about your experience and exactly what info you gave to your bank. I would like to get this purchased this week.

I got an invoice from Arthur with all the different intermediary bank info, but my bank says that usually they would just send it directly to the foreign bank where the account is. They aren't sure why these other intermediaries would be required.

_________________
http://www.ancilesecurity.com

sorry to tell, but really once they know you u will have all answers to whatever you wanted from the Acelab TS
me my self was having hard time as you mentioned with the TS & prices as well.

but for now, i can say they have the best tools regardless of the price, and you should know that with their tools
you will make more money more than you might imagine, kind of investment on something and slowly ur getting it back
from ur client side.

No one here disagree that their tools are the best, but their TS might be BAD,
from my experience with them, i had those problems before. but am not saying this for them as an AD.
it is the truth, they have changed @ least with me or maybe with others which i dono

wish u good luck with them and others as well dude.

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein

Anyone help me out??

_________________
http://www.ancilesecurity.com

Seems like more of a question for your bank... IIRC it had to do with something like final bank will only accept wires from a particular list of trusted intermediaries, and sometimes the intermediaries do the same. So maybe it takes 2-3 links to go from your hometown bank in the US to Soft-Center's hometown bank in Russia.

_________________
You don't have to backup all of your files, just the ones you want to keep.

That helps a little. Thank you. Like I said, it's a small credit union and the lady there had never done such a thing. Maybe that will help explain it to her.

_________________
http://www.ancilesecurity.com

Credit union can not make an international wire transfer, because of that they use another bank like middleman between your CU and destination bank to process wire transaction. In EU banks use SWIFT number in US is different they use ABA Routing Number. You will need to contact SoftCenter or check online witch bank is corresponded bank in US for Russian Bank. Maybe you will need to spend little more time on phone and e-mails until you finish this transaction.

_________________
Sistrum Data Recovery
http://www.sistrum.mk/en

My favorite and most successful tool is another working flash device with a matching controller. We simply move the memory over and 9 times out of 10, are able to simply copy the data off. Of course, finding the matching controller is easier said than done.

_________________
Luke
Recovery Force Data Recovery

Well i said i was going to SZ on the 7 NOV....... ( my undercover video did not come out (mainly legs and i nearly got my head cracked open by security)), but i got some 'stills'



Pssst... ya want any bare board controllers (or knock off Kingston/Sony kit....)

_________________
Universal Declaration of Human Rights: Article 19