All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 11 posts ] 
Author Message
 Post subject: Monolith UFD - interesting case
PostPosted: August 30th, 2018, 17:21 
Offline

Joined: October 24th, 2009, 15:22
Posts: 872
Location: Poland
Sorry for simple language, but i copy/paste this text from FB, I'm so lazy to write it again ;) I know that almost all of you know details of this kind of job.

We take's also action on data recovery for hopeless cases. Recently we received damaged pendrive. Once connected - it did not show any signs of life. We decided to took pendrive apart. It turned out that we have monolith device - integrated controller system and memory module in one piece. In this case pinout must be developed. It means that we need to connect 16 small wires with corresponding points on the device. Usually, we have around 25-35 points on device. Of course, it can't be done randomly but we need to work according to the communication protocol to make it possible to read information directly from memory module.
We do it on regular basis. But the main problem is what to do when on the device surface we do not have enough connections? Light solution - you can buy X-ray machine with hight resolution (about 0.5 MLN $), x-ray device and find connection points. Hard solution - with deduction approach, experience do the same job. If on the pendrive surface you can't find sufficient number of the connections, sometimes we must go deeper: 2nd layer and deeper: 3rd layer…. and deeper: 4th layer. Only at the 4th layer we found missing connections to the memory module. You can view it on the attached picture (currently we have multilayer electronic PCBs, 8th layer and more). While working with such a device you need to be very carefully and try not to damage remaining connections because data will be lost.
All the work was done exemplary, the memory module was read and all data recovered :)


Attachments:
arvika.jpg
arvika.jpg [ 929.47 KiB | Viewed 8791 times ]

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices
Top
 Profile  
 
 Post subject: Re: Monolith UFD - interesting case
PostPosted: August 30th, 2018, 17:37 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15463
Location: Australia
Very clever!

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Monolith UFD - interesting case
PostPosted: August 30th, 2018, 19:09 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3844
Location: Adelaide, Australia
without xray, how did you know where to dig, without damaging any needed traces in 2nd and 3rd layer and hitting the correct point in the 4th?


Top
 Profile  
 
 Post subject: Re: Monolith UFD - interesting case
PostPosted: August 30th, 2018, 22:39 
Offline

Joined: July 30th, 2012, 3:37
Posts: 310
Location: Fairfield, CT USA
How do you go down a layer so precisely? I can go down one layer with an Xacto knife before damaging the PCB on those tiny USB 3.0 drives.
When I use a laser to ablate the area I hit silicon like a MicroSD card.

_________________
Recover My Flash Drive


Top
 Profile  
 
 Post subject: Re: Monolith UFD - interesting case
PostPosted: August 31st, 2018, 2:55 
Offline

Joined: October 24th, 2009, 15:22
Posts: 872
Location: Poland
We take into consider:
- we find most of signals from pinout
- we analyzed traces and vias position on monolith

Based on this info we can guess with high probability where the memory module is inside and where we can meet traces. To remove layers we use scalpel and dremel with small abrasive stone. But you MUST BE VERY carefully.

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices


Top
 Profile  
 
 Post subject: Re: Monolith UFD - interesting case
PostPosted: August 31st, 2018, 3:43 
Offline

Joined: November 29th, 2006, 10:08
Posts: 7843
Location: UK
Awesome work as always Michal!

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!


Top
 Profile  
 
 Post subject: Re: Monolith UFD - interesting case
PostPosted: August 31st, 2018, 5:33 
Offline
User avatar

Joined: January 28th, 2009, 10:54
Posts: 3452
Location: Greece
:shock:
Incredible!
Amazing work Michal!

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners


Top
 Profile  
 
 Post subject: Re: Monolith UFD - interesting case
PostPosted: August 31st, 2018, 7:28 
Offline
User avatar

Joined: February 9th, 2009, 16:13
Posts: 2520
Location: Ontario, Canada
This is why Arvika is my goto lab for outsourcing complex flash cases. Of course, Michael makes most seem simple with how fast he is able to recover them.

_________________
Luke
Recovery Force Data Recovery


Top
 Profile  
 
 Post subject: Re: Monolith UFD - interesting case
PostPosted: August 31st, 2018, 20:58 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3844
Location: Adelaide, Australia
Thanks Michal, it makes sense. Thanks for sharing, it is always interesting to see any flash work, and success instead of the 100th doom and gloom story!

These very simple devices have a few complicating factors. It takes confidence to go digging around the layers. These are almost certainly test/research devices, not customers, so if you get the urge to try it, remember Michals warning. don't try this on customers devices unless you either are the last stop before the rubbish bin, or are VERY confident.

If you are researching this, you could buy 3 or 4 of the exact same drive and start mapping the layers. You are able to afford a few small mistakes. Magnification is a real help here.

If it is a customers, it is very hard in a lot of cases to find the exact same device. some look extremely similar an the surface, but can have revised traces inside layers, have different firmware etc making it hard to ever get a 100% same donor.

I know that Arvika has helped not only their customers and other labs with outsourcing, but also the tool vendors with developing the tools themselves.


Top
 Profile  
 
 Post subject: Re: Monolith UFD - interesting case
PostPosted: September 1st, 2018, 20:24 
Offline

Joined: August 18th, 2010, 17:35
Posts: 3636
Location: Massachusetts, USA
Nice research initiative. Good stuff. Thanks for sharing.

_________________
Hard Disk Drive, SSD, USB Drive and RAID Data Recovery Specialist in Massachusetts


Top
 Profile  
 
 Post subject: Re: Monolith UFD - interesting case
PostPosted: September 2nd, 2018, 7:34 
Offline
User avatar

Joined: March 6th, 2010, 3:46
Posts: 601
Location: Kolding | Denmark
Good job Michał :)

_________________
Digitalsupport Data Recovery
https://digitalsupport.dk


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 11 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 20 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group