A Photographers Lucky Escape – Flash Memory Recovered

A 64GB Lexar Professional arrived with us one morning and was diagnosed with a failed micro controller chip.

two nand flash memory chips

This sort of problem cannot be repaired so the only option was to remove the flash memory and read the RAW data from it. The two nand flash memory chips this device used are split into two banks so four dumps of data were made.

This is only the start of it, the clever algorithms the micro controller used have to be replicated in software and several attempts made to make the data corruption free. The dumps are sliced back together and then spilt upagain before finally being in a state where the users precious photographs recovered and his reputation saved.

Flash memory is very portable and compact but very vulnerable to failure so regular backup of your solid state devices is necessary.

Logical SSD Recovery

Data Recovery from a 250GB Samsung SSD

The initial diagnosis for this drive was that the drive is damaged (according to an IT company that this customer sent the drive to before arriving to us at R3), and that it also kept freezing and blue screening.

Logical SSD recovery Samsung 250GB

18/08 at 10:36am Drive Received

The drive arrived with us Friday morning, we booked it in to our database and we informed the customer of the arrival of the drive. It was under assessment as we didnt know the exact fault of the device as of yet.

18/08 at 13:42pm Drive Diagnosed

The drive was diagnosed as logical as it became ready and had no SMART errors present on the drive. The drive was then sent to clone.

18/08 at 14:52pm Drive Cloning

At this point the drive was put for cloning, and since it was a 250GB SSD we managed to get it cloned in no time at all. It finished cloning with 0 errors and 0 unread sectors. This suggested that it was definitely a logical issue rather than media degradation. If the device was degraded it would have finished with unread sectors as when a drive degraded it means that the sectors are unreadable, hence the conclusion of the failure being logical.

18/08 at 15:19 Data Transfer

The data transfer process began. The image drive was scanned for missing files and files system as the engineers knew it was a logical issue. The customer was asked to give us some indication as to what to look for as this makes it easier for the engineers so they know if they are on the right track to recovery or not. After the scan it was clear to see that there was not much in the shape of files that you would normally see on a person’s computer. It looked just like a fresh install of Windows. This unfortunately means it leaves us with one last option which is what we refer to as a RAW scan, where we pick and choose file headers for certain file types for example .jpg, .mov etc and the software searches sector by sector and finds these files headers and will recover them to the designated location. A RAW recovery will fetch back corrupt and non-corrupt files. This is the only problem with this type of recovery.

21/08 at 13:31pm – Job Paid For, Data Sent Back

Fortunately the customer was relaxed about what was being sent back to him, and was informed that there was not a lot we could do regarding the situation of the drive so we decided to send the RAW data (and the folder structure) back to the customer.

In conclusion, if a drive has been formatted or overwritten then there’s always a chance that we can recover the data. If you have accidently formatted your hard drive, or perhaps a computer shop has told you something and you want a second opinion why not call us on 0800 999 3282 or alternatively email us at [email protected]

Flash Memory & Mobile Phones

Presented at the lab was a Samsung Galaxy S3 with the familiar boot loop fault.

Upon closer inspection & attempted flashing of a recovery PIT firmware, the fault was apparent – EMMC NAND failure.

Todays mobile devices rely more and more on high capacity, high speed NAND flash memory with ever increasing strain on the memory itself.

Most mobile devices use the internal memory for several intensive tasks from the moment the device receives power.

This all contributes to premature failure & erratic behaviour as the devvice struggles to read/write failing block of the NAND memory

If you think your mobile phone has this issue, or you think something else is wrong. Get in touch with us at R3, call us on 0800 999 3282 or alternatively email us at [email protected]

Problems on a Microscopic Scale

An SSD arrived at the lab with a problem serious enough to render it inoperable. After running some diagnostics using software it soon became apparent there was more than just a firmware issue..

The SSD in question, an Intel 530 series mSATA device. Intel have been a little sneaky here, the CPU is branded as ‘Intel’ but it is actually a Sandforce CPU in disguise (Triggering Safe Mode on the SSD displayed the actual CPU revision).

Straight away, the chances of recovery are low, and a NAND analysis would be useless as the Sandforce series CPU’s all use 256-AES hardware encryption – seriously secure storage. Due to this, the only viable recovery method would be to repair the SSD and attempt to extract data.

damaged SMD component | R3 Data Recovery

An inspection using our high-powered microscope showed there was a damaged SMD component located in the power circuit of the SSD. This tiny component is responsible for driving the power MOSFETs (aka Gate Driver). The gate driver controls the switching frequency of the MOSFETs to give a nice smooth voltage output to the NAND IC’s on the SSD. To confirm this, after probing the VCC filter capacitors next to the NAND IC’s, there was ZERO voltage present – the CPU & Cache WERE receiving voltage.

Due to the drive being damaged (partly removed from the PCB) the MOSFETs were in ‘standby’ waiting to be triggered. This in turn caused the SSD to revert to ‘Safe Mode’ – this can also be interpreted as a firmware issue.

After finding an identical SSD donor drive – the damaged gate driver was replaced with some nifty micro-soldering. The SSD powered up normally and was able to be imaged successfully without any errors!

USB Memory Stick With Cheap Controller

USB stick which was a company branded freebie

During our initial free assessment, our engineers identified that the NAND chip was covered in resin and cannot be accessed or removed for the recovery process.

What we call a NAND read wasnt an option with this particular job as the NAND chip which is where all the data is stored was covered in a sticky resin, which means removing the NAND chip would be near impossible. The only option we had was to replace the controller to see if this was the problem or not. However, with this USB stick the controller was an incredibly rare one, and one of our engineers said hed never even seen one like it before!

Along with the resin the other main problems with these cheap manufacturers USB sticks is the poor quality of soldering and solder that is used. Using poor solder can lead to loose connections and the device not working at all. The only way to avoid the problems these devices in particular cause is to regularly back up your data.

Customers need to be aware that cheap USB sticks from eBay or Company Freebies are cheap for a reason, manufacturing is often with cheap flash memory and has a higher chance of failure. In most circumstances R3 Data Recovery would have been able to recover the data from the failed USB stick if it wasn’t for the sticky resin that the manufacturer covers it in.

For a free quote call us on 0800 999 3282 or alternatively fill out the online dignostic form on the right and one of our assistants will give you a call and talk you through the process and give you a free assessment over the phone.

Data Recovery On SanDisk Cruzer USB Memory Stick

A recent customer of R3 Data Recovery dropped of a SanDisk Cruzer USB memory stick. These are small popular devices now days as they have a funky design.

SanDisk Cruzer USB memory stick

A quick inspection revealed a problem… no internal electronics! The printed circuit board was missing, presumed either still attached to a USB port of dropped out and lost forever.

We have seen this problem before and can only say if you own one of these funky devices please take precautions when handling them.

A Dog’s Dinner

They say a goat will try to eat pretty much anything it smells, but when your pet tries to eat a memory card from a camera that’s when you call R3 data recovery for help.

Dent from the dog's tooth in the plastic casing of the SD Card

When a customer had removed a SD card from their camera and placed it down on the sofa at their side the family pet dog grasped the opportunity to have a play picking the card up in its mouth… The card was quickly retrieved from the pet’s jaws but a dent from a tooth was visible in the plastic casing.

All flash memory devices use Nand chipsThe damage to the plastic casing turned out to be more than superficial and once this packaging was removed the printed circuit board was heavily damaged and the only option to remove the single component that holds the precious data that is the Nand flash memory chip.

All flash memory devices use Nand chips to store the data and even though these have a very robust construction they can’t withstand flexing or pressure from sharp objects and unfortunately in this customer’s case the outcome wasn’t good because the nand chip had a fracture to one side.

We tried to read the Nand chip but wasn’t able to get any response from it. This is indeed a sad story but you would be surprised how many damaged flash devices R3 data recovery do recover so it’s always worth a try by giving us a call.

Don’t Try This At Home

A recent case at R3 Data Recovery Hospital is particularly interesting because it perfectly describes why a customer shouldn’t try any recovery techniques themselves before seeking professional help.

SD Card nand removed

A USB memory stick arrived with us one morning on an emergency service. It was noticed the plastic casing was removed and the printed circuit board visible rattling around in the envelope. All the pieces were carefully removed from the envelope to find the flash chip yanked free from the printed circuit board and stuck to one half of the casing with hot melt glue commonly used in these cheap Chinese devices.

The flash chip had been ripped free and its tiny delicate connections bent out of shape. The heat from soldering processes renders these connections very brittle but luckily we were able to repair it and get a recovery.

This was a lucky case with a good ending but could have been very different story if the flash chip had been more seriously damaged. Before trying anything at home, contact the professionals here at R3 Data Recovery Hospital, our team will be able to give you an on the phone assessment as to what they believe the problem is which should give you an insight into what needs to be done to recover the data from your device.

Give us a free call on 0800 999 3282 or complete the form on the right hand side of this page and let us help you with your lost data.

Sandisk Memory Stick Meets The Power Drill

The lab received a USB stick that had been drilled into using a power drill so the customer could make the USB into a key chain. The power drill had drilled through the casing and actually caught the PCB and the edge of the NAND chip damaging its pins (legs).

Sandisk memory stick damaged nand chip

The NAND chip is what we refer to as flash memory which is where the data is stored, possibly the worse part of a USB you could drill into!

However luckily majority of NAND chip devices have unused pins on the chip, and the customer had only damaged the unused pins! This meant the data and the integrity of the data was 100% and a full recovery was done.

Phew! I’m sure a lesson was learnt.

Why You Should Never Open Your Own Hard Drive?

why you not want to open your own hard disk

One of the jobs that we received recently at R3 Data Recovery Hospital was in such a terrible state the chances of recovery was almost zero to begin with. The customer had attempted to open the drive himself before the delivery to the lab had been made. Without a clean room, required knowledge and proper instruments to do so, this is always a terrible idea.

This particular job had the all evident signs of everything that could go wrong in the attempt of opening it yourself. If the customer had refrained from trying this and sent in the drive to R3 untampered with, maybe the outcome of the recovery could have been positive. Instead after the initial diagnosis from our engineers from what was left of the drive, the job was deemed unrecoverable.