Hi All,

I noticed something very weird, sometimes when I got a flash card or USB to recovery (most of the time with a messege that I have to format the drive), I insert the flash into my computer and run on it a software like GetDataBack for FAT32/NTFS and others for image the data.
Sometimes the software succeed to recover all the data and in the other times can't find any file. Seems Like someone did an unrecoverable erase.
When I format the drive (when the customer gave up his data), the drive works fine without any problem.
Why sometimes the software succeed to recover the data and sometimes doesn't?
I tried varied of softwares and got the same result. When one of the softwares can't recover the data, the others can't too recover the data and still after format the drive works fine.

Any suggestions why does it happen?
I hope I made myself clear.

By the way, I heard about flash extractor of SoftCenter. Is that tool can recover a data that those softwares can't?

Many Thanks!

Please don't take this the wrong way.......

This is the same as when i get sick, sometimes it is fine after a day others it lasts for weeks I may even have to get medical assistance, other times the doctor tells me he does not know why i am sick.


Before you can classify WHY, you need to know the WHATS (the same way a doctor works, analyze the facts , compare against a database).

1. What is the internal controller.
2. What is the Flash type (MLC/SLC)
3. What tools did you use to recover.
6. Did you use a WRITE BLOCKER


Have you performed any sort of statistical analysis across 1-6 above? (is what you say proved by the facts, or is it just a feeling you have)

That said ANY sort of recovery operation where you have a flashcard/flash stick that employs an intervening integral controller significantly reduces the chance of a successful recovery of the data.

To put that in English:

The greatest chance of correctly recovering the data requires the memory storage chips to be removed and 'special' hardware employed to assist in the recovery.

That said there are ALWAYS levels to recovery, and these will vary from ol granny smith trying to get back a picture of the grand kids, to a police investigation of a Pedophile where absolutely ANY data is valuable, but if your goal is to have the highest chance of recovering anything, then you NEVER NEVER plug the raw device back into power, EVEN IF the Write protect tab is "on".


Read the following to get you started:

Bez, R., Camerlenghi, E. , Modelli, A. & Visconti, A. (2003) Introduction to flash memory. Proceedings of the IEEE, Volume: 91, Issue: 4, 489 - 502.

Phillips, B. J., Schmidt, C. D. & Kelly, D. R. (2008) Recovering data from USB Flash memory sticks that have been damaged or electronically erased. e-Forensics ‘08: Proceedings of the 1st international conference on Forensic applications and techniques in telecommunications, information, and multimedia and workshop, 1–6.

_________________
Universal Declaration of Human Rights: Article 19

Flash media regularly connects to a machine and asks to be formatted. In many cases it is just a file system problem. In some cases it is bad blocks but in far more cases it turns out to be a controller or component failure on the device.

Flash extractor is a brilliant tool, but the learning curve is steep if you have not attempted this kind of work before. You will need the soft-center hardware/software and SMD rework tools. You don't mention what the device is, it is possible that you will have to create your own rig to access the data if your flash card is of the monolithic type.

Those are examples of flash devices that I didn't succeed to recover the data.
All of them with the same symptom - a messege that I have to format the drive.

http://img683.imageshack.us/img683/4674/dsc04033r.jpg

Is the Flash Extractor could have been helpfull on those devices?

Many Thanks!

For two out of the three, Yes.
The sandisk is probably encrypted, so this one can not be recovered.
The usbstick and the other flash card should not be a problem.

Dobre

_________________
Murphy was an optimist

Datarecovery in Belgium, Holland, France and Germany
Datarecoverytools http://www.drtools.eu

So in order to recover that from such those devices I should buy Flash Extractor and some tools for unsolder the chip?

By the way, what are the extra add ons that I shouls buy together with the Flash Extractor?
http://www.soft-center.ru/reader2eng/

If you puchase this, you will need to learn to use it. I think based on some posts you make that you will not learn this quickly.

Do you have any knowledge of the structures of Flash? Are you familiar with soldering and de-soldering equipment?

I think you ask many questions to which you should already know the answer.

With regard to the Flash reader from Soft-Centre, this will leave you with many questions and much confusion. You would be better with a more automated tool like PC3000 Flash, but even this will require some work from you to learn.

I'm afraid hddguy is correct.

Even if you have the latest tools, you will still need a working knowledge of Nand-Flash and integral controller responsibilities, and in true market spirit they are mostly different, there is no standard for controllers and even the "standards" for Nand-Flash chips -ONFI-, is damned flakey

I have performed extensive research on the integral Nand-Flash controllers and to be honest it has left me less than 100% convinced that the tools currently available on the market are capable of a fully automated recovery that is SHA2 intact, --even the Salvation data tool--

why?

1. Because The tools attempt to model the controllers decode/ operations routines with reverse engineered software.
Which in turn is a combination of the following:
I. Chip de-cap and algorithm rip/read from the Nand-Flash 'boot' area.
II. Analysis of the block allocation maps.
III. Speaking to the controller manufacturers too get copies of the source (I know only 1 controller manuf. that allows this)

2. After meeting and speaking to some of the controller designers , I find that "fixes" and "tweaks" are regularly performed on the controller firmware, and in some cases "specials" are produced that are still marked with the same controller chip ID and package number.

So whatever you decide, it is going to require significant work on your part.

_________________
Universal Declaration of Human Rights: Article 19

If you can't figure that out then there's no way you're going to be able to figure out how to recover flash

_________________
You don't have to backup all of your files, just the ones you want to keep.

Some neet gear you guys chatiing about here. I like the soft-center gadgets. i bet they cheaper than the pc3000 flash too aint it.

Does pc3000 support flash chips off ssd drivers? just off topic

_________________
It seems that the unluckiest people in the world are those that don't backup.
Free Solutions
Picasaweb- Pictures and movies | Dropbox - Documents and other..

Significantly

_________________
You don't have to backup all of your files, just the ones you want to keep.

Some neet gear you guys chatiing about here. I like the soft-center gadgets.
i bet they cheaper than the pc3000 flash too aint it.

The issue is not what a product supports or its cost.
Try not to look at it as a "once it is solved, thats the end of it" it is not a single task the "tool maker" performs by working out how a controller works and the job is finished.

Take for example a "controller" lets call it "A", the tool maker spends months working out how "A" works, by one of the methods outlined above.

Exactly how are they going to do that?
Why do you think the tool makers are always issuing bug fixes?
In many respects, the industry is treated as a joke and a cash cow.

What happens when the manufacturer of "A" decides the block allocation routine needs work and then re-codes the controller firmware.... Simple the tool is "broken", how is it going to be fixed?

Any idiot can build a Nand-Flash chip reader(just look on the net at some of the attempted abortions), therefore it basically comes down to an issue of pure "research and development" the million $ question is :

who/what funds the R&D

The fastest way to become knowledgeable in these subjects is to build your own tools or at least understand HOW you would build such a tool.

_________________
Universal Declaration of Human Rights: Article 19

You do realise that 2 of these devices are Sandisk don't you? The USB Stick looks like a Sandisk Cruzer and is likely to employ AES 128, possibly further obfuscation by the U3 utility. The Extreme III card will be monolithic if genuine and probably protected by a XOR algorithm (which is crackable - but we're getting advanced).

The third looks like a generic branded SD device and it is difficult to say who manufacturers the flash and controller.

Yes, the left one probably also is a sandisk, but some of those i got in were not encrypted.

Dobre

_________________
Murphy was an optimist

Datarecovery in Belgium, Holland, France and Germany
Datarecoverytools http://www.drtools.eu