Test readout, help to understand

[okton]

I am still playing with FT2232 and made read of NAND memory from real USB memory.
Patient is TC58NVG4D2ETA00 controller TC58NC2233G5F. The memory read looks like in attached picture.
I can see some almost repeatable patterns on some pages, but majority of pages are a kind empty.
I am not 100% sure the visualisation from GIMP is correct, but in hex editor it looks like first block is "occupied", second also, third is kind empty. Later even blocks are occupied with data and odd empty, until like 20-40% of memory. Later part of memory are interleaved blocks containing 00 only and FF only.
Could it be the USB stick has not been factory initialized or never filled with data?

Attachments

[Gregory]

Could it be the USB stick has not been factory initialized or never filled with data?

I suggests working on a memory that is 100% fully written, now hard to tell is this problem with wrong parameters or empty memory.

[okton]

I suspect first visualization was incorrectly generate, it did not cover whole memory.
I have also tried to use another tool to read NAND.
For the previous read the disk was empty, but only few hundred MBs at the begining was zeroized.
There were some sectors (from OS point of view) not zeroized. I overwritten whole disk by zeros then readback to verify.
First picture if whole memory, second picture is top left corner.
Questions:
1. What are those white/black stripes? Are those physical damaged "blocks" or factory marked as bad? (starting about 45% of first image).
2. What are those set of pages at the begining? The looks like set of pages full of data, interleaved by empty blocks. Is it firmware for controller? (it is better seen on second image).
3. I wrote the pendrive with ~2GB of data, the chip contains 2.25GB of space, looking at visualization, only 60% of NAND is consumed, where is data stored? Is controller smart enough to reuse some blocks/pages as they all contains zeroes? Or not all pages has been read correctly?
4. there are few pages not full written (market in red) what are those? Some metadata related to pages/blocks?

Attachments

[okton]

Trying to find where is data, I created FAT32 FS on the pendrive, and fill whole 2GB with totally random data. The layout does not differ a lot, from the pictures above, still 2GB consumes about 1GB in NAND memory.
I tried different ideas, one was to check if there is data is somewhere "after" the last block? Addressing allows that, I tried to read block numer 2084 and got some data.
I tried to match those data, is they already exists somewhere "earlier" (if NAND addressing will rollover or sth). I could not find 4 bytes from page 2084 anywhere in the read 0-2083. I checked again datasheet and now I am really confused, by datasheet, storage area for data should be continues, blocks are addressed 0-2083, but I see some empty space in range 0-2083 and something which looks like data after block 2083. What I am doing wrong? I know my tools are hobby quality, but I had investigated addresing bits what they contains, and everything looks correct.

Attachments

[fzabkar]

I think it makes more sense to write the LBA number to each sector, ie data = LBA. I recall that one of the tool vendors provides a free utility for this purpose.

[fzabkar]

I believe Pattern Writer is the "data=LBA" tool.

https://web.archive.org/web/20200303061713/http://www.flash-extractor.com/downloads/

[okton]

I think it makes more sense to write the LBA number to each sector, ie data = LBA. I recall that one of the tool vendors provides a free utility for this purpose.

I can suspect where this will lead me, but how to deal with XOR without dedicated tool. If the read is not trusted for data and address I am adding another variable to equation.
At least can somebody confirm and deny, the NAND should behave more reliable, data should not be compressed anyway (even some simple way like reusing content of adjacent pages/blocks), addressing should be linear as I read in datasheet, etc.

[csava]

This flash memory uses different power modes. Please check if pins 20, 24, 34, 37, 38, and 39 are connected to VCC power

[okton]

This flash memory uses different power modes. Please check if pins 20, 24, 34, 37, 38, and 39 are connected to VCC power

Some pins were unconnected, read after hardwiring ALL power pins on first view in hex editor more more complete. I will try to prepare visualization later, but looks promising.
Csava can you explain more what does mean "different power modes"? I understand that sometimes digital circuits works "worse" with not complete power supply/grounding, but in case of this chip only "middle" parts of NAND array were not readable. Are the parts of NAND array isolated from some power pins?

[csava]

Different departments require different power sources (core power, bus power). On this flash memory, both VCC and VCCQ are 3.3V. Due to the minimal current on the bus, it is possible that the flash memory can still operate. However, the absence of power can leave the flash memory in an uncertain state.