Remote Flash Recovery

[Jared]

OK, I know this is a topic that I've discussed before but I'm visiting it again because it actually needs to get done this time.

I've got a case here using a typical TSOP-48 8Gb NAND that can't leave my office for legal reasons. It's got to be done here, but I'm really not looking to invest heavily into flash recovery right now. I ordered the Soft-Center reader so I can at least get an initial dump of the NAND to be able to send someone who has the necessary software to descramble and XOR it out. I'm looking for someone who's able to do this. I know that at times you may need to direct connect to the reader to re-read bad sector areas, etc. and I'm hoping that can be accomplished using USB over IP software like Flexihub which makes it as if it's directly connected to the remote machine.

So my questions are:

Anyone have experience with doing this?
Anyone willing to do the work at a reasonable price? (I can potentially bring in a lot of this work if you want it)
Any flaws with this plan like software being locked only to a certain reader?

If I can find a regular guy to do this, I don't mind registering my reader and locking it to their software license. Flash hasn't ever really been a field I've wanted to get into that much.

 

[LarrySabo]

Have you checked out D3 Consulting: http://www.d3consultyou.com/

 

[Jared]

As it tuns out, after removing all the rubber cement they had buried this PCB in, the NAND has a hairline crack running straight across it. I told the customer it's a lost cause, but they are intent on sending it to another company who claims to have some success with cracked NAND chips.

Anyone ever heard of successfully recovering data from a NAND cracked right across the middle? I surely haven't.

 

[Jared]

Have you checked out D3 Consulting: http://www.d3consultyou.com/

Never heard of them. More and more I'm thinking that I'll eventually need to venture into flash, if for no other reason than just the convenience of being able to handle the cases that show up here.

Having done a number of complex RAID cases, I don't suppose it'd be that difficult to learn. Just that it's hard to justify that amount of work for such little payout in most cases. Can easily make $2-3K on most RAID cases, but it's rare anyone would pay over $1000 for a thumb drive.

Just out of curiosity, for those of you who do a lot of flash cases, how long do you typically spend on an average flash memory case? (not counting taking the dumps).

 

[Amarbir[CDR-Labs]]

Jared ,
We all need to venture into nand now or tomorrow .Its a very paying job imho .I would start and advice you to bur pc 3000 flash first and then resolute and softcenter ,Once you have all three you are into the game .Also mobile phone recovery is getting bigger and better

 

[HaQue]

[post]5881[/post]

Have you checked out D3 Consulting: http://www.d3consultyou.com/

Never heard of them.

Sasha and a few others from Rusolut (VNR) are from there. I am not sure of the exact business model or situation, but I believe Rusolut is started by a few guys from D3 as either an extra arm of the company or its own entity. Either way, You probably wouldn't find smarter guys anywhere.

 

[pcn]

In my opinion Flash is very different from HDD recovery and one can not compare RAID recovery with the complexity a simple thumbdrive can have. We do not get many cases for flash but if someone is willing to pay for it it turns out its a difficult job (dynamic xor, unknown / not typical controller, unknown xor, ...). Time spend on a flash drive depends on memory chip type (quality), capacity and the algorithms used to scramble the data, it can be one hour or a week.
The problem with nand recovery for me is that most ppl don't want to spend much money (i.ex. 150€ on a 8GB drive with bad controller) for a recovery where the device costs only a few euros and most people do not store that important data on these drives. Mobile phones is a completely different story (they are willing to pay), but with more and more encryption on these devices the only way to recover data in the future will be a chip-level repair of the phone itself.

 

[Jared]

In my opinion Flash is very different from HDD recovery and one can not compare RAID recovery with the complexity a simple thumbdrive can have. We do not get many cases for flash but if someone is willing to pay for it it turns out its a difficult job (dynamic xor, unknown / not typical controller, unknown xor, ...). Time spend on a flash drive depends on memory chip type (quality), capacity and the algorithms used to scramble the data, it can be one hour or a week.
The problem with nand recovery for me is that most ppl don't want to spend much money (i.ex. 150€ on a 8GB drive with bad controller) for a recovery where the device costs only a few euros and most people do not store that important data on these drives. Mobile phones is a completely different story (they are willing to pay), but with more and more encryption on these devices the only way to recover data in the future will be a chip-level repair of the phone itself.

My VNR system should be arriving today, so I guess I'll get to see what you mean soon enough. Been reading through all the VNR documentation, and it seems manageable. I doubt it can be much harder than trying to figure out a 16 drive RAID 50 with no distinguishable metadata.

 

[HaQue]

I doubt it can be much harder than trying to figure out a 16 drive RAID 50 with no distinguishable metadata.

#FAMOUSLASTWORDS

pcn wrote:
In my opinion Flash is very different from HDD recovery and one can not compare RAID recovery with the complexity a simple thumbdrive can have.

but then you go ahead and compare it!

you could get 10 cases in a row that is more complex when you add all the variables. Flash recovery almost sent me around the bend and up the creek in a barbed wire canoe with no paddle this year....

advice, get help as soon as you hit a stumbling block!

 

[Jared]

Looks like that may be starting already (though I don't think this issue is me).

Been trying for three hours to just get any NAND to read using this used ruSolut reader, and I can't get any NAND to ID. It just goes yellow for about 20-30 seconds, then goes red. I've tried three different NANDs, two of which were pulled from brand new fully functional thumb drives. The pins are all straight and clean, I've checked all the contact's under a microscope and the pins all appear to be nicely pinched between the top and bottom contacts of the socket, pin 1 is clearly labeled, but still nothing.

I can't be this stupid, there must be something wrong with this reader or adapter. Any insights from you NVR guys?