Hi,

I have a Samsung SSD (Model: PM 851) that has recently failed. I have had it looked at by 2 data recovery companies who have independently confirmed that the processor/controller (which from my research I've discovered to be a 4th-generation 3-Core Cortex-R4 Samsung MDX Controller [S4LN045X01-8030]) has failed. I have been advised by the companies that the data is likely still residing on the NAND chips and that technically the data could be retrieved using 'chip off' techniques. They have further advised that this would be a futile exercise however as the processor/controller uses a unique XOR pattern which obfuscates the data, rendering the data, should it be recovered successfully, unreadable.

I have two questions that I am hoping someone may be able to help answer:

1. Is there any way of emulating the controller/processor programatically i.e. decoding and reassembling the data by finding the XOR key? Has anyone had success doing this?

2. Is there any way of repairing the controller or replacing it with another (set to use the same XOR key)? Again, if anyone has done this I'd like to know if it was successful.

Please understand that my knowledge of all this is very limited.

Many thanks in advance,
Matt

This controller is not cracked yet, but Samsung controller usually can be made as chip-off. It is worth to try do it - of course if memory chips will be in standard type. Can you make photo or scan of PCB?

_________________
Odzyskiwanie danych

Hi,

S4LN045X01-8030 is MEX, not MDX as far as I understand it. It is the same controller I am currently analyzing, and I made some progress, but I didn't fully succeed yet: http://www2.futureware.at/~philipp/ssd/ ... Manual.pdf

If you figure out anything about it, please let me know.

Hi Arkiva,

Thanks for the reply. Here are some photos of it attached.

I've done a little more reading since posting and I am being led to believe that even if I get the data of the chips it will be 256-bit encrypted, and unable to decode. Is that correct from what you know?

Thanks,
Matt

Thanks for the link sourcerer. Here it is referred to as 'MDX' - http://www.m2m-direct.co.uk/downloads/v ... 0drive.pdf. Though from what I understand this drive is the same as the 840 EVO.

From your investigations, can all of the data be retrieved from the chips using JTAG. If this is possible, is there any way to then decode the data? As far as I understand it is 256-bit encrypted. Is this correct?

Thanks for the link sourcerer. Here it seems to be referred to as 'MDX' - http://www.m2m-direct.co.uk/downloads/v ... 0drive.pdf. Though from what I have read, the PM851 is the same as the 840 EVO. From your investigations, is it technically possible to download all of the data from the NAND chips using JTAG? If this is possible, is there any chance it can be decoded? From what I have read, it is 256-bit encrypted so there would be no chance of decoding it anytime soon. Any info much appreciated.

Please write description from memory modules. I'm curious what model it is used.

_________________
Odzyskiwanie danych

Sorry, what do you mean by this? Do you want me to type out the numbers on the chips? If so, please let me know which chips. Apologies for my ignorance! I have attached another photo of the Front without the sticker if this helps. Many thanks

There is some description on chips: Samsung xxxxxxxxxxx Can you write it here, because I can't see from photo.

_________________
Odzyskiwanie danych

Sure, based on the last photo I attached, the text on the four large chips going clockwise from top-left to bottom-left are as follows:

Chip 1 (Top Left): Samsung 404 K90KGY8S7M-CCK0 HPL7189S
Chip 2 (Top Right): Samsung S4LN045X01 8030 N6ZKXA S1401 ARM
Chip 3 (Bottom Right - smaller chip): Samsung 404 K4P4G324EB FGC2
Chip 4 (Bottom Left): Samsung 404 K90GY8S7M-CCK0 HPL7189S

There is also a very tiny chip on this side of the board, which reads: 280ACW3NA

The board itself has the following printed on it: MZMTE256HMH0

Let me know if you need anymore info.

Many thanks

So memory chip it is BGA-316 type. There is no adapter for it. Theoretically we can read it manually by wire connection, but it is job for masochist. Chip has 16 or 32CE.
So for this case need wait for adapter or for solution which can repair FW drive (of course if it is FW problem).

_________________
Odzyskiwanie danych

The CPU and the 2 Flash chips are the same as EVO840.
I guess that the firmware is mostly identical to the EVO840, it just uses PCIe instead of SATA interface.
Interesting to see that the CPU is capable of both PCIe and SATA.
I think that most of the firmware research I did also applies to your case.
The memory module (K4P4G32...)
is also 512 MB, but it seems to have a different voltage level than the ones that are on the EVO 840. But that should not make a difference in practice.
That small chip is directly next to the 2 large identical flash chips, right? I think that's the I2C temperature sensor. Those are always located directly next to the flash chips to make sure that the connection is as short as possible so that they can measure the temperature fast and accurately.
The 5 golden pins seem to beJTAG. The 2 pins next to it could be SAFE mode or UART, I am not sure.
I found data that looks like crypto keying material for what seems to be 192 Bit keys, which could be for AES-256. Those keys seem to be fixed in the firmware, so perhaps you could try to replace the controller with a good donor controller, since they might all use the same keys.
If the SSD just does not want to start, I think it is more likely that one of the several bugs that I found in the firmware could have caused some memory corruption, which should be repairable in principle through JTAG.
In the past 2 weeks I wrote the memory map of the EVO840, at least all the hardware related things should apply to your controller as well: http://www2.futureware.at/~philipp/ssd/MemoryMap.pdf

From what the data recovery company said, I don't think it's a FW problem. This is what they said:

The SSD controller suffers from media corruption. Media Corruption occurs within the chip that controls the connection between the drive and the computer. Corruption can modify or destroy important information which can render a storage device inoperable and inaccessible.

When you say read manually by wire connection, do you mean using JTAG? Would taking the chips off not work?

Thanks

Unfortunately, I don't think the key is the same on each drive. The data recovery company said that a controller wouldn't work. Just to clarify, if the data was taken off the chips using JTAG it would be encrypted? Am I right in thinking that the drive automatically encrypts data as it writes? Thanks

It could be that every drive has a different key, yes. Or perhaps some other relevant parameters are different. I dont fully understand it yet, I am still researching it.

Yes, there are a few bugs in the controller firmware that can cause memory corruption which can lead to such Media Corruption, which can render the device inoperable, since the SSD verifies its integrity when it is powered up, and when it finds something damaged, it stops working to prevent further damage.

The manual wire connection would be to take the flash chips (Samsung 404 K90KGY8S7M) off and to solder small wires to their pins to connect to them, since there are no adapters on the market yet to read them easily.

For JTAG you have to connect to the easily accessible golden Vias at the edge of the board.

With JTAG you could connect to the controller and talk the controller, and diagnose and fix the problem it has with starting up. My theory is that you would get access to your data again as soon as you have fixed that problem in the controller.

Matt ,
Most Of The SSD's Have Issues In Translator and Hence They Do Get Detected But No User Area Data Access .Depending On The Controller And Its Current Firmware Tool Developers They Keep Adding Support For Them Slowly And Slowly.One Such Tool Is PC 3000 SSD .This is Whats Supported In Samsung Yet And Lots of New Samsung Controllers Are Going To Be Supported By Summer 2017

SAMSUNG family

Samsung MLC (S3C29RBB01-YK40 CPU based);
Samsung 470 Including Apple models (S3C29MAX01-Y340 CPU based) ;
Samsung PM810 (mSATA version of 470) (S3C29MAX01-Y340 CPU based);
Samsung 830 Including Apple models (S4LJ204X01-Y040 CPU based);
Samsung PM830; (S4LJ204X01-Y040 CPU based)
Samsung 840 (S4LN021X01-8030 CPU based);
Samsung PM840 (S4LN021X01-8030 CPU based);
Samsung PM841 (S4LN021X01-8030 CPU based);
Samsung 840 Pro (S4LN021X01-8030 CPU based);
Samsung 840 Evo (Including mSATA) (S4LN045X01-8030 CPU based);
Samsung PM851 (Including mSATA) (S4LN045X01-8030 CPU based);
Samsung CM871 (S4LN054X02-Y030 CPU based);
Samsung 850 Pro (S4LN045X01-8030 CPU based);

So Instead of This Please Wait .But Do Power This Drive Once Weekly So the Memory Cells Remain Intact with Your Data .All Said And Done Three Other Companies Make Chipoff Solutions Like Softcenter ,Rusolut And Acelab ,They if Have a Solution now can be tried .Some of the most intelligent users of such tools are here in forums .So Take Your Call

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com

I developed a tool to quickly automatically diagnose a Samsung MEX / EVO 840 with start problems:
https://github.com/thesourcerer8/SSDdiag/
It should be also helpful in your case, at least the hardware diagnostic parts should work for the MEX controller.

@mattsbsmith, I would check the on-board power supply voltages. If you could provide good quality photos, I could identify the test points for you.

_________________
A backup a day keeps DR away.

There is present on pcb terminal RX/TX pins which is a little tricky to find and solder wires to them.
S4LN045X01-8030 long time supported and microcode could be downloaded via terminal. Data Recovery possible. Strange thing that both different companies you were dealing with failed to recover. We already did couple of same SSD with success.

_________________
Angel Data Recovery

Did you ever find a solution to this problem? I just had my PM 851 fail in the same manner