Data recovery, SD Card. NAND 4GB (TSOP-48)

[mabel_photo]

Good day all,
I've been given an SD Card (4GB) which is not working. The card was used in a kodak digital camera. The camera doesn't see the card and neither does any reader I've tried. Computer says it wants to format the disk. The owner is hoping to get loads of baby pictures recovered. I see lots of data recovery software, and have tried them with no luck. The software requires the card to be formatted. (low level... or Quick Format).
But no luck there. When I put the SD card into the slot on my laptop, windows recognises it, but then gives me an I/O error if I try and access it, or format it.
I popped the SD card open and I see the controller, the NAND flash, and some caps & resistors.
The NAND flash is a Micron 29F32G08CBABA (TSOP-48).

My plan was to remove the flash and put it in another SD card. I got myself another SD card... same make..same label, etc... but the guts are totally different.

Looking for options. I know there are data recover places... but I would like to try this on my own.
I'm looking for an SD card that uses this NAND flash chip, or a memory stick device that has a TSOP-48 socket on it???

I could try and change the controller on the SD card, but it's a 4 sided chip that is sitting tight against the NAND flash. I can't read the p/n on the controller. I'll have to take it to work and look at it under the scope.

I'll get some photos.
Thanks,
BD

[HaQue]

Hi.
Do not change the controller.
Do not unsolder NAND and put it in another card.

The software requires the card to be formatted. (low level... or Quick Format).
But no luck there.

I hope you didn't try to format.... It probably would not have continued formatting but this will not help.

What it needs is NAND unsoldered, read in a NAND reader designed for data recovery, and data on NAND then re-assembled back to a proper disk image to undo all the mix, error correcting, XORring and wear leaveling etc that the specific controller has done to the data.

You should take to a DR business.

What is the controller chip?

[arvika]

Do not play with someone data!

Chip must be read and than you must emulate the controller. If you don't have proper tools and knowlage, outsource it.

[HaQue]

The owner is hoping to get loads of baby pictures recovered.

+

if I try and access it, or format it.

does not add up

Why would you try and format it if you want to recover pictures?

Do you know what formatting is? It is writing a new BLANK file system so the card is ready to store files.

Granted, a quick format might not totally kill your chances, but never format a system when you want to recover data.

You can try and contact user lcoughey, Luke at http://www.recoveryforce.com/ I know Canada is big, but it might be close enough

[mabel_photo]

Do you know what formatting is? It is writing a new BLANK file system so the card is ready to store files.

Not totally true. You are refering to a full format.

A "quick format" doesn't erase the data. I've watched loads of videos and read on various forums that the first step in data recovery from an SD card or Memory stick is to try and format the drive. All the tutorials indicate that data is not touched.
Watch this video. Just the first 2minutes.
http://www.youtube.com/watch?v=jPuy6SnXZq4
I've tried this. I filled a memory a memory stick full of pictures, videos and doc files.
I then performed a quick format through windows.
The memory stick then showed up blank. I ran RECUVA, and it pulled out all the files.

My plan is to remove the NAND flash and try it on another SD card, or change out the controller.
My guess is there is something wrong with the controller.

[fzabkar]

A "quick" format will quickly destroy a FAT file system so that it makes it extremely difficult, if not impossible, for fragmented files to be recovered. NTFS is more resilient in this regard, but it is still foolish to format it. In any case, the chances are that your card has a FAT file system.

The bottom line is that, if you managed to recover your data after a format, then it will have been in spite of it, not because of it. At the very least, clone the card before you do anything to it, assuming your customer's data means anything to you.

I've tried this. I filled a memory a memory stick full of pictures, videos and doc files. I then performed a quick format through windows.
The memory stick then showed up blank. I ran RECUVA, and it pulled out all the files.

Exactly. Your file system was completely unfragmented, and it may even have had an NTFS file system. Now do the same with a FAT32 file system, but delete several files after filling up the drive, and then add new files to this drive. Do this a few times (to fragment the file system), and then see how many files you can recover intact after a "quick" format. To understand why formatting creates the problems that it does, you need to understand the structures of the File Allocation Table, and the structure of the directory entries.

[Keatah]

1up for that explanation. While there's even more to it, this suffices.

[Vulcan]

To reinforce what other members have already said:

Do you know what formatting is? It is writing a new BLANK file system so the card is ready to store files.

Not totally true. You are refering to a full format.

Sorry, but you are wrong - even a quick format does write a new blank filesystem (as HaQue said), but does not erase the data, as you later agreed. It is that overwriting of filesystem metadata (i.e. FAT tables, in the case of a FAT-formatted card) which causes problems with later recovery, especially of fragmented files or unusual file types, for the reasons which fzabkar has explained.

I've watched loads of videos and read on various forums that the first step in data recovery from an SD card or Memory stick is to try and format the drive.

I've seen them too and those forums / videos are wrong. That is absolutely not the "first step" except for those who, through lack of research, understanding & experience, do not realise what they are destroying.

Interestingly, some time ago, I found one specific situation where quick-formatting a card would appear to help for Windows (and only Windows) - it's interesting, but too long a story for now. The point is that, as we keep saying on here, recovering under Windows has limitations, and if someone had quick-formatted the heavily-fragmented card I was recovering, the result would have been a disaster for subsequent recovery (which I confirmed as a test, by doing the quick format after I had successfully recovered the photo & videos using other methods, and then trying to recover files from the the quick-formatted card; not good).

My plan is to remove the NAND flash and try it on another SD card, or change out the controller.
My guess is there is something wrong with the controller.

You're likely to be wasting your time, although you might be lucky, depending on exactly what you do. However if your guess is wrong, you may lose your customer's data permanently - this is not a risk-free "try X and if that doesn't work then try Y" situation. Such guesses and risks are not the way that I would want you to proceed, if I was your customer. However if you have already decided what to do, and aren't listening to the advice from here (which you asked for!), then it seems we're done. What a shame.

[Keatah]

Ohh gosh.. Where *IS* the facepalm smiley when I need one..

[Vulcan]

Where *IS* the facepalm smiley when I need one..

I think it was guru who found a suitable Star Trek facepalm image (though not as small as a smiley) when we needed one in the past...

Which particular part of the story so far makes you want a facepalm smiley? There are several to choose from.

[fzabkar]

Where *IS* the facepalm smiley when I need one..

:) I think it was guru who found a suitable Star Trek facepalm image (though not as small as a smiley) when we needed one in the past...

Unfortunately I still remember that one. :-)

[Keatah]

The formatting. This seems to the be one of the first actions people do.

[Vulcan]

@fzabkar: lol

@Keatah: Gotcha With the number of YouTube videos and amateur blog postings etc. where people seem to recommend doing this after minor filesystem corruption, and it seems to "work", they think it's the right thing to do. They don't realise that alternative techniques would have produced an even better result (more files recovered and/or lower risk). Same thing with running chkdsk - it's not a data recovery utility!

As far as I can work out, some people mistakenly think the message from Windows saying that the device needs to be formatted is an instruction, whereas as we know, it is actually an error message, with formatting the drive being just one option - and not the one to choose, if doing a data recovery!

I'm sad that the OP seems to be choosing to ignore the good advice from other members on this thread, and may lose the customer's baby photos as a (completely avoidable) result.

[Keatah]

...never mind..

[digitalferret]

@Op (if s/he ever returns).

Well intentioned help I'm sure but, seriously, don't screw with someone else's treasured possession. If it's valuable give it to a pro service.
Think #responsibility #accountability #liability

If it's just that you like the adrenaline rush *risking it* or the kudos for a chanced success, do it on something valuable of your own.

-----------

just for fun:
Been a lurker here for some years now, and sometimes pondered if there are equivalent trade fora discussions going on... say like medical.
Imagine.....

Visitor:
Guys, my neighbour brought his aunt over, she has a sore throat.
Only I saw a youtube about this once and, as i have a Leatherman, think I can help.
So, I need to ask how to do a tracheotomy.

Guru:
Whoa dude, don't!
You really need a doctor to diagnose that and maybe the hospital further down the line.

Visitor:
d*mn elitist doctors, so secretive.
Trying to keep us from helping ourselves so their salary isn't affected I'll bet.
Why won't they just tell you what to do. I mean, I did several years working as a butchers errand boy. It's not like I don't know one end of a knife from the other.
There's plenty of videos online, I'll have a go......

Substitute any sort of craftsman, watchmaker, vehicle mechanic ....

o.0

[fzabkar]

@digitalferret, the big difference between the data recovery profession and the medical profession is that the latter are accredited by a recognised institution. There is no equivalent accreditation system for the data recovery business, so there is nothing preventing anyone from hanging out their shingle as a data recovery professional, whether or not they have any real experience or knowledge at all. And that's exactly what happens.

The closest thing I've seen to a data recovery course is Scott Moulton's 5-day Data Recovery "Expert" course which most professionals will tell you is laughable.

[northwind]

Here we go again...

[hddguy]

The closest thing I've seen to a data recovery course is Scott Moulton's 5-day Data Recovery "Expert" course which most professionals will tell you is laughable.

This is because we have a basis for comparison as to what is viable and valid and what is not.

[digitalferret]

@fzabkar : agreed regarding anyone can set up and start trading.

the problem is there are no obvious paths to enter the DR game yet other than joining a company or furthering your own hobby status by self teaching.

But, there are people coming away with hideous hack jobs even from *accredited* professionals; medical included.

If you want to practice, do it on your own gear.
There is a wealth of free software available and drives are cheap on ebay.
Roll your sleeves up, off you go.

Most guys on here know this. Newcomers less so.

Keeping it on topic, accreditation or not, it is simply unethical to mess with someone else or their property when you don't have the means to do the job properly.

Regardless of the validity of Scotts offerings, there is little else out there to give wannabe's a hand up.

That or pushing some бабки at Ace, Atola, Deepspar or софт центр.

In the words of Dirty Harry: A man's got to know his limitations.


Kern