Recovering data from flash devices such as USB Sticks and memory cards is a particularly demanding process.
There are various hurdles that should be overcome, especially if the damage concerns the controller of the device or - even more so - the memory chips on which the data is written to.
Flash technology itself has limitations:
All flash devices use NAND technology (this is not an acronym, it comes from the logical NOT and AND operations used in programming).
NAND technology has specific properties on which the lifetime of the storage medium depends.
For example, when data is written to a NAND cell, to rewrite data to that cell, the previous ones must be erased.
This writing and erasing of data is done by sending electrons to the cells (to put it very - very - simply). These electrons pass through an insulator. The position and location of these electrons determine whether current will flow to the cell or not and whether that cell is occupied.
When we write and erase data from a cell, as the electrons come and go, the insulator wears down to the point where it struggles to keep the electrons where they should be, resulting in leakage and/or an inability to determine whether the electrons are where they should be.
This in turn explains the "finite number of writable cycles" we often mention. It means that the flash technology itself has a limitation on the number of data reads and writes.
The lifespan of a flash device depends on several factors, the main one being the quality of the materials used during production.
One of the biggest challenges in recovering data from these devices is monolithic devices. To these are added the devices with dynamic XOR and the LDPC devices, which are currently universally unrecoverable. LDPC devices (Low Density Parity Check) which are also known as Gallagher devices from their originator Robert Gallagher, according to whose code, "a linear binary block for which the parity check matrix of interest has a low density of ones, ” so there are fewer 1s than 0s in its binary code. This complicates the decoding of the content to the point where it is impossible to convert it into a useful form.
A specialized data recovery lab will follow these steps to recover data from a failed flash device:
- Reception of the device and signing of the confidentiality agreement NDA
- Discussion with the customer, obtain crucial information regarding the conditions under which the failure occurred, the history of the device life, and the needed data (type, location on the disk) that have to be recovered.
- Run a detailed diagnostic. The check includes the examination of the individual functions and components of the device in electronics level.
- Inform the customer about the results and get required approval.
- Perform the basic recovery process, depending on the fault. For example, if the device shows damage to its controller, then a chip-off procedure should be followed. We need to: Desolder the memory chips, read them with the correct parameters and then apply ECC and XOR, correct the Bad Bytes with RR and "compose" the raw dumps in a way that it's possible to obtain functional data).
- Extract data from the clone.
- Evaluation of the final result and rechecking where needed.
- Inform client about final result and get approval.
- Copy the data to a new hard drive and deliver to the customer.