DonsDeals Blog: Memory Cards - Hacking SD Card & Flash Memory Controllers Reverse Engineering and Rescuing Data - Reverse Engineering a NAND Flash Device Management Algorithm by Joshua Wise

Here's a great How To Article on Memory Cards - Hacking SD Card & Flash Memory Controllers Reverse Engineering and Rescuing Data - Reverse Engineering a NAND Flash Device Management Algorithm by Joshua Wise. Check out the links at the bottom, for more info too...

Don

Reverse Engineering a NAND Flash Device Management Algorithm

Around June of 2012, I had gotten myself into a very bad habit. Instead of carrying my SD card in my camera, I left it sticking out of the side of my laptop, presumably intending to do something with the photos on it eventually. On my flight home from Boston, the predictable thing happened: as I got up out of my seat, the machine fell out of my lap, and as the machine hit the ground, the SD card hit first, and was destroyed.

I was otherwise ready to write off the data stored on that device, but something inside me just wasn't happy with that outcome. Before I pitched the SD card in the trash, I took a look at what remained – as far as I could tell, although the board was badly damaged, the storage IC itself was fully intact (although with a few bent pins).

The following is a description of how I went about reverse-engineering the on-flash format, and of the conclusions that I came to. My efforts over the course of about a month and a half of solid work – and a “long tail” of another five months or so – resulted in a full recovery of all pictures and videos that were stored on the SD card.

If you're just looking for the resources that go with this project, here are the pictures of the hardware, and here is the source code.

You can discuss this article on Hacker News.

Introduction

It is probably fitting to start with a motivation for why this problem is complex; doing data recovery from a mass-production SD card seems like it should be a trivial operation (especially given the interface that SD cards present), but as will become clear, it is not. From there, I will discuss the different parts of the problem in detail, both in terms of how they physically work, and in terms of what it means from the standpoint of a data recovery engineer.

Skipping on down...

Data extraction

Of course, none of the device-management information is relevant if the data can't be recovered from the flash IC itself. So, I started by building some hardware to extract the data. I had a Digilent Nexys-2 FPGA board lying around, which has a set of 0.1” headers on it; those headers are good to around 20MHz, which means that with some care, I should be able to interface it directly with the NAND flash.

A bigger problem that I had facing me was that the NAND flash was physically damaged. The pins still had pads on them, ripped from the board; the pins were also bent. Additionally, the part was in a TSSOP package, which was too small for me to solder directly to. I first experimented with doing a “dead-bug” soldering style – soldering AWG 36 leads directly to each pin – but this proved ultimately too painful to carry out for the whole IC. Ultimately, I settled on using a Schmartboard; I sliced it in half, and allowed each side to self-align. This meant that I didn't have to worry about straightening both sides at the same time – as long as I got them each individually, I could get a functional breakout from the flash IC. (The curious reader might enjoy some photos of my various attempts to re-assemble the NAND flash.)

Read More...
http://joshuawise.com/projects/ndfslave

Home - Projects - Words - Résumé - Contact