flash recovery | DataRecoveryUnion.com

Data Recovery

Flash Data Recovery

DATARECOVERYUNION.COM16 years ago8 months ago017 mins

Flash disks have become ubiquitous media for everything from computer data, mp3 players and digital cameras. It has replaced the floppy disk as means to carry data around. Flash disks are solid-state devices and, therefore, have no moving parts. Plugging it into the USB drive, the flash drive is automatically recognized by the computer without any need of installing additional software. With expected lifetime measured in hundreds of thousands of write-erase cycles, flash drives are expected to last up to 10 years. That’s more than twice that of a hard disk.

Flash disk portability however leads to a higher probability of damage due to environmental factors. Aside from the regular causes of drive failure, flash drives could get wet in the rain, the casing could shatter when it is accidentally dropped, or it could be damaged while inside the camera.

The difference in data storage between a flash drive and a regular hard drive or a floppy is due to the data residing on a chip. This allows for a truly random access across the whole media. In fact, the disk access algorithm makes sure that the data is spread evenly among data sectors with the use of “wear leveling algorithm.” The flash disk has a finite number of write/erase cycles. If it were to keep on writing to a particular sector, that sector would literally wear out from use much earlier than the other sectors. The wear leveling algorithm ensures that the sectors wear out evenly. And also because of the wear leveling algorithm, when a data sector wears out, the rest of the disk is sure to quickly follow.

In some instances, the camera cannot distinguish between the file system on the flash disk and force a format. Early flash disks used FAT12 or FAT16. FAT32 is used by current generation large capacity flash disks. If the digital camera fails to detect the flash drive’s capacity it might wrap around data while writing the photo and over-write system areas.

There are times the flash disk could not be read by the computer. Though attributed to the computer, this is an error caused by the camera or MP3 player OS. Unplugging the drive while it’s writing data may also cause a corrupted flash drive.

Flash data recovery in most ways is like recovery from any other media using FAT. The only difference is the location of the media files. The data can be recovered by using data recovery tools capable of reading FAT. Typically for cameras, the file structure is fixed. The camera’s limited operating system will write to a specific folder on the directory. The same goes with MP3 players. The mp3 files have to be located in a specific directory for the mp3 player to locate and play them. Some specialized tools look for the specific folder where the media files should be.

Treating all the data on the disks as data files, disk recovery programs or other utilities are capable of correcting any errors. The Windows CHKDSK utility treats the disk like any other drive.

In case of lost data, flash data recovery is just like recovering data from any other medium but, again, with slight differences. Because the data is stored differently, there are more tools available for flash data recovery. Available tools and utilities include flash data recovery specializing in picture files or mp3 music files. Other specialized utilities which can be used for flash data recovery are those which specifically recover data from FAT drives. In case the pictures were accidentally erased from the camera, these utilities are also able to recover them and recover the picture.

In some cases, data recovery can be even simpler. A flash disk recovered from a lake or which got wet from the rain may still be usable after making sure that the circuitry is completely dry. And a flash disk with a broken case might even be usable. In both instances, it would be good to test first by plugging it in. If the drive is still readable, just copy the files before deciding what to do with the flash drive.

Flash drives’ typical failures:

When we are coming to the topic of flash data recovery, it’s very necessary for us to have a general view of the typical failures of flash drives such as the SD, CF, SM ,MMC, XD, USB Pendrive, MemoryStick, etc.

It’s believed 90% of flash drives’ failures are due to corruption in the lookup tables which convert logical addresses (what your computer sees) to physical addresses (what the controller sees). Other failures are usually caused by controller failures, power surges, and worn or broken solder joints.

NAND memory has many quarks.
* Each block is only good for a finite number of writes after which bit errors occur, for example the word “flash” may become “slash”.
* Data can be read in pages (2K bytes) but must be written in blocks (128K bytes).
* Before a write can occur the block must be erased, if power is lost before a write completes the sector remains erased.

Lookup tables

Lookup table is an array or matrix of data that contains items that are searched. Lookup tables may be arranged as key-value pairs, where the keys are the data items being searched (looked up) and the values are either the actual data or pointers to where the data are located. Sometimes, lookup tables contain only data items (just values, not key-value pairs).

Each word (two bytes) contains the block number which holds that sectors data. For example 0×001A is the block number for sector 0, 0×0419 is the block number for sector 1, etc. If the block numbers are incorrect the controller won’t know where the actual data is stored. In this example some of the block numbers are incorrect because of bit errors caused by an aging NAND chip. Some controllers may automatically detect the error and prevent further writes. In this case the user may get an error message asking them to format the drive.

In this example the flash drive was unplugged before a write operation on the lookup table completed leaving the table filled with 0xFFFF from the erase cycle. The user may be prompted to insert removable media, the drive may be displayed as 0MB in size, if the drive is listed it may be shown as an unknown device.

As NAND memory ages bits inside a block can become stuck, newer high density MLC chips are plagued by this problem. To combat this controller manufactures use ECC (Error Correcting Code) to fix a limited number of bit errors. Once the number of correctable bits per sector is exceeded flash drives may act strangely for example frequent file system corruption may occur or the drive will stop working. In these cases I’ll often see color shift in pictures, half the image will be normal and the other half will be a different tint. This is because part of the image was stored in a good block while the other part was in a bad block with sticky bits.

Weak Solder Joints

Wear and tear on the drive can cause solder joints on the NAND memory chip or controller to weaken. If the drive is recognized the total capacity will only be a few megabytes. If you connect the drive while applying LIGHT PRESSURE to the controller and NAND memory you may be able to retrieve the data. Remember, weak solder joints account for LESS THAN 10% of failures. DON’T APPLY MORE PRESSURE if this doesn’t work, you may damage the NAND memory chip if you press too hard.

Hacked USB Flash Drives

Some unbranded or counterfeit flash drives are hacked to display the wrong drive size using the manufactures mass production tool and then sold as larger capacity drives. For example a flash drive with a 4GB NAND chip will report itself as 8GB drive. These drives often work until the user starts to fill the drive with data after which it becomes unreadable. These fake flash drives are usually sourced from china and sold on eBay. If your data is NOT important you can download the mass production tool for the drives controller and reformat the drive using the correct capacity.
Broken USB Connector

If the USB connector was broken off the USB Flash drive you can recover the data by repairing the trace using a conductive pen.

1. Use a set of tweezers to place whats left of the trace on its original path
2. Expose the copper at the end of the broken trace by scraping off the sealant with an XACTO knife
3. Use a conductive solder pen (available online or at radio shack) and carefully recreate the broken trace.
4. Let the paste dry, then use a needle or XACTO knife to scrape off any excess.
5. Make sure the trace is repaired by doing a continuity test with a multi-meter from the pad to the end of the trace.
6. Quickly solder the old USB connector back on the board. The paste left by the pen won’t hold up to heat for very long, don’t spend too much time trying to make the joint perfect.
7. CAREFULLY connect the flash drive to your computer, the connection is VERY weak and easily broken. I recommend connecting the drive to a USB extension cable for easier insertion.

Bad Surface Mounts

Leaving a flash drive plugged constantly in may cause premature failure of the surface mounts which regulate voltage to the flash drive’s components. Often the resistance or capacitance values of a surface mount will fall out of spec and not produce the correct voltage. This often represents itself as a dead flash drive (no led, not acknowledge by the computer) or overheating.

As for flash data Recovery, the NAND memory chip must be removed and read with an external reader, then the lookup table is reconstructed to retrieve your data.

As for flash data recovery tools, there are not many good ones to recommend, so far ACE flash data recovery tool and the coming flash doctor can be worth a try. There are many data recovery providers who have their own tools for this kind of recovery, but according to customers, the result is not ideal!