How to get started learning Nand Flash Data Recovery

[clewis]

Hello, I'm a new member of the group. Thanks for the great information you all provide here.
I want to know how to get started with learning Flash Nand Data Recovery.
I want to know do I Have to order one of the expensive readers like PC 3000 flash or the one from ACE and RUsolutions ?
I've seen readers on Ebay for only $175 and less. Also the DIY reader that is on hack a day.
http://www.ebay.com/itm/201460762850?_t ... EBIDX%3AIT
that's the reader I was thinking about buying....But I'm not sure about the saving data from the flash and reconstructing it so I can see it in file format...
Can someone please help me understand that part. And let me know what I need, any books, articles...ANY kind of information about the subject....I haven't found much out there. Thanks

[labtech]

Generally speaking there are two parts to flash recovery:
1) Getting an image dump of the flash data using a reader
2) Making sense of the data using software

So, in your case, for the dump, say you get the cheap reader and you can figure it out along with what software is needed just to get the dump. But then, what platform/software will you use to make sense of the data files in the dump? Or at least anything that is feasible in terms of getting some results as oppose to banging your head against the wall reinventing the wheel?

So, I am basically saying, with cheap reader, you won't get far and it will be frustrating. Flash recovery is tough as is anyway.

For more information, read a bit on the Flash section of the forum. Plenty of info there to begin with about what tools are available and so on.

[HaQue]

while it is an interesting and novel project, The reader on hack-a-day will just take up valuable time struggling to get it to work, and is not suited to flash memory recoveries. There are many different types of nand this wont work for.

You absolutely need one of the top 3 nand recovery options, but some say at least 2 of them is better.

for articles, there are some good ones at Rusolut.com. these go into detail about recoveries and should show you why you need support from a dedicated DR tool. you will need to just go through and read all the available articles/tutorials and probably a few times. You shouldn't be asking questions too much until you are confident you understand the info.

A lot of people, myself included, think there is little flash info out there, but while true, the info that IS out there is probably either vacuumed up and stored on a hard disk, but never learnt in depth, or glossed over with "I kinda understand the concept, but where are the step by step tutorials.."

There are so many different combinations of nand and controller properties that it really is a case of learning as much as you can about the basics, then getting into it and solving each obstacle as you come to it.

forum questions like "can you tell me how to read nand chips?" wont get any different answer than already got but "how do I read this intel chip with ID XXX?" would probably get a better answer. You cant be vague in flash there is simply too many variety, no standards, no rules of thumb etc.

also when you get a tool, learn it inside and out, and practice on flash you have bought and are working. nothing is harder than trying to learn a tool and having a chip that is dodgy so you can never work out whats going on.

be prepared to spend a lot of money and even more time than you can imaging. Some recoveries take upwards of 10 hours banging your head against a wall, then one little setting is stumbled on and a full recovery in minutes.

[arvika]

Take datasheets for nand memory. For example some Microns. There is a lot of interesting information. Actually flash cases is usually more complicates than HDD drives.

[Dmitri]

I want to know how to get started with learning Flash Nand Data Recovery.
I want to know do I Have to order one of the expensive readers like PC 3000 flash

Yes, if your intentions are serious, you need tools, not hobbyist toys you can spend unlimited time with. And that's exactly "need", not "would be good".

With their relentless effort in making everything cheaper, vendors have to implement more and more complex technologies. And you have to keep up with them. That requires quite some time even for a talented engineer, who isn't starting from scratch.

And IMO time is the most precious resource these days. The later you start, the harder it is to catch up with the current market.
PC-3000 flash will allow you to unload at least a part of that work to a whole team of developers and achieve the results you'd unlikely be able to get on your own.

At the same time be sure to not expect "single-click recover-it-all wizard" solutions, they do not exist. You'll need to work and learn a lot yourself.

As for the cost, again, if your intentions are serious, tools like PC-3000 will pay themselves many times over.

[arvika]

At the same time be sure to not expect "single-click recover-it-all wizard" solutions, they do not exist. You'll need to work and learn a lot yourself.

Dmitri, they exist in SC If there is a model for such case of course.

Every tool is very good. Sometimes you need all three for one case.

[DRUG]

Hi clewis,

First of all, I've been there with that DIY nand reader (viewtopic.php?t=31253)

Is it worthy ? no.

Why ? Even though you will be able to dump, you will not have help / software to aid you in recovery and reconstruction.
You will be able to determine things like page size, ecc, voltage etc once you have more experience (HaQue once told me the directions towards learning flash recovery, you can see them here: viewtopic.php?f=10&t=31089)

By the way, you will find flash recovery harder then hdd recovery, and even when you have 2 or 3 years of experience in this field you will wake up every morning not knowing what to expect from your next case (refurbished nands, unknown models, etc)

Good luck.

[jeremyb]

You make flash recovery sound so difficult.. Adopt the SandForce Data Recovery Model.. Guaranteed Money.. 100% Success Rate / 0% Results

[fzabkar]

Start by learning some electronics. Don't assume that every flash based storage device can be recovered, or needs to be recovered, using chip-off methods.

[clewis]

Well thanks for the reply everyone. I see it's more complicated than I thought....but that's why most repair shops don't do it....so I'm still interested and won't give up learning about the subject. I see this technology being around for quite some time. So in the meantime I think I could do as Dmetri suggests in doing the dumps which i think i can handle quite well. Then outsource the dumps. should still be a decent profit in that until I can learn it myself.

Thanks again everyone....i wasn't expecting this many replies.

[jermy]

So in the meantime I think I could do as Dmetri suggests in doing the dumps which i think i can handle quite well.

that's what you think
you'll find out that getting the dump is not always so simple
different chips, different block and page sizes, different voltage and the list goes on, not to mention when it comes to monolithic, finding pinout and good soldering skills

[DRUG]

So in the meantime I think I could do as Dmetri suggests in doing the dumps which i think i can handle quite well.

that's what you think
you'll find out that getting the dump is not always so simple
different chips, different block and page sizes, different voltage and the list goes on, not to mention when it comes to monolithic, finding pinout and good soldering skills

^^this.

Not trying to advertise or anything, your best bet is learning with the pros and buying a specialized tool.

Currently I'm working to get a compant budget to buy VNR + their classes.

Starting with DIY flash readers may give you some insight, but even if you end up recovering the data (0.5 out of 10) chances you will do it assuming your are fresh in the game, you will loose so much time that will not make it worthy.

[labtech]

Can you elaborate a bit on "that's why most shops don't do it"? What are they saying?
And what kind of shops are those?

[Igor_Loskutov]

Hi there!
Rusolut recently held a series of educational webinars about the full NAND Flash data recovery process. All videos are uploaded to Youtube. Feel free to learn
https://www.youtube.com/playlist?list=PL4FTP856GcGcYCDnfNAsE5JgQ146n3AdG
I would also recommend NAND Flash Data Recovery cookbook. It's a very decent material.
http://adreca.net/NAND-Flash-Data-Recovery-Cookbook.pdf

[HaQue]

Thank you very much, I am sure many will appreciate the work and time gone into presenting this.

[samstown]

Thank you.