Mobile phones, tablets and other devices that store data on flash memory chips present new challenges in terms of data recovery. In many instances, a physical dump can’t be obtained without direct access to the memory chip.
Mobile phones, tablets, USB drives and solid state drives all store data on NAND flash memory chips. There are essentially two main methods to undertake data recovery on flash devices – chip-off and JTAG. Both techniques allow data recovery engineers access to a low-level image of the device’s data. Traditional magnetic hard drives tend to be very similar in design and have a common approach to storing data. Flash devices, on the other hand, can vary massively in structure, with numerous file structures, algorithms and memory types. For this reason, data recovery from flash devices is much more difficult and time consuming, in contrast to magnetic storage devices. To obtain a bit-for-bit copy of the raw data stored on the flash memory, the NAND chips need to be interrogated directly – and chip-off and JTAG are the main techniques to do this.
Chip-off involves removing an individual memory chip from a circuit board and reading it. De-soldering the memory chip from the circuitry has to be done with extreme precision; our engineers always work under microscopes, as one tiny mistake can lead to permanent data loss. Upon removal from the circuitry, data recovery can be attempted by reading the chip with data extractors. NAND chips, utilised in USB flash drives and solid state drives, are typically the easiest type of flash chip to work with in terms of data recovery, due to the pin configuration being standardised. Other chips, like BGA, have multiple connectors soldered to the motherboard, which can be much kore difficult to remove.
JTAG is another method of flash data recovery and doesn’t involve removing the chip from the circuitry. Although this is a more lengthy process, it means the media won’t be damaged. It can be kept in a working state, which is often a requirement of forensic data recovery investigations. Both chip-off and JTAG produce a low-level image, which is then decoded by data recovery engineers so that the user’s data can be rebuilt. Technology is steadily improving, and our new PC-3000 Flash Spider Board Adapters allow our team to undertake data recovery on devices that previously were deemed a lost cause.
