Recovering data from under the compound

    image
    Wow and risk running into a minus for this pun "from under," but I hope the habrapublic will forgive, because the post on the case. The text is small, but a lot of sense and pictures.

    This is a story about a NoName USB stick unpacked, which Windows at one point began to offer to format and define as 8Mb.
    The chip can not be soldered ... How to recover data? Welcome under the category ..

    Continuing the theme of the articles and songs of Dima Bee .: “And the impossible is possible,” let's consider the case when data recovery at first glance seems impossible. In the previous article, the flash drive was given its full volume, but there were zeros in all sectors, but stubborn engineers managed to recover data from an empty space .

    4GB is explicitly written on this flash drive, but Windows defines it as 8MB.

    image


    And in each sector of these 8 megabytes, the same information of the controller is repeated, and not the user data.

    image

    This behavior is typical for the controller if the number of unreadable memory cells exceeded its “waiting”. To recover data, you need to solder a memory chip and shamanize with various software and hardware complexes.

    But this case is special, because the memory crystal is filled with a compound , and not in a case design. Chef, what to do?

    We are lucky and the controller is not a “drop”. You can read the label and refer to the datasheet for pinouting contacts to the NAND memory.

    image

    Dismantling the controller and soldering the wiring to the DATALABS cassette to connect to the PAK PC-3000Flash. Wiring

    image
    0.2 mm is not visible.

    Read the chip ID:

    image

    And so it is a surprise! She is 8GB!

    Clearly, this flash drive is made of "rejection". That is, initially from a bad memory. Aliexpress brothers bought defective 8GB chips and made 4GB flash drives based on them.

    About such crafts you can make a separate post, but this one is about data recovery.

    We got access to the memory, then we analyze the dump, subtract the extra blocks, collect valid ones in the right sequence, and hallelujah! The data is in place, not without damage of course, but the main data array is in order.

    You cannot post a picture with the data, everything is strictly in our office with confidentiality.

    For the clumsiness of the article, I strongly ask you not to kick, the author is still a techie, not a copywriter.

    PS My colleague in the shop on Friday wrote about fake flash drives and in the comments someone noted that Habr is no longer the one that technical articles are not plus, but they are bunches of unicorn.
    I hope the above information (mini solution) does not look like nonsense and will be interesting and useful to someone.

    Also popular now: