USB Flash Drive Data Recovery

Chip On – This is how we generally start the data recovery process under most circumstances. Under a microscope using a spectrum analyzer and / or oscilloscope, we spend our time trying to repair broken solder joints, diagnose and replace faulty components and do what is necessary to repair the original PCB (Printed Circuit Board) and retrieve the users original data. This technique leaves the original NAND memory IC(s) in tact and on the PCB. This is the best way to insure the customers original data is retrieved. This is also the least expensive type of recovery.

Chip Off – This is where the actual NAND memory IC(s) are removed from the original PCB with a digitally controlled hot air re-work station. The NAND memory chip is cleaned, inspected and placed into a fixture to retrieve a raw data dump to a technicians workstation computer. This process usually results from a failed attempt to repair the original PCB and is quite common. Often times the original PCB has a failed controller and there is no means to restore its functionality. Once a raw data dump is retrieved, a hex editor and custom software are used. The original controller algorithm has to be emulated to reverse engineer the manipulations of the data performed by the original controller. There are many different manipulations that are carried out by the original controller and a lot of trial and error is performed. We often equate the reverse engineering of the manipulated data to a Rubix Cube. There is a very basic starting point with a few known parameters but many tries of different combinations of data manipulations are performed until a recognizable pattern begins to unfold and the process continues until the data is recognizable as a known file system and its unique file system patterns. Many of the manufacturers program the same controllers differently and the same is true for how the manufacturers make use of a specific NAND memory chips. This can be a very time consuming process and is more expensive than the Chip On recovery.

verbatim-usb-flash-drive
verbatim_usb_flash_drive_inside

Epoxy Dipped USB flash drive recovery – Care is used to remove the original epoxy. Epoxy Dipped NAND IC’s are removed after a careful removal of all the epoxy surrounding the IC itself and then the process is continued as a typical chip off recovery as detailed above.

COB-Flash-drive-photo

Monolith Recovery – This is the most expensive of all recoveries and we do not have a set price for monolith recoveries. It involves a very tedious process of slowly and carefully removing the exterior coating of the monolith to expose the internal circuitry without damaging it internally. Then the essential points need to be identified and small wires are soldered to these points under a microscope. At this point, a raw data dump can be obtained and the process of reverse engineering is performed to get the data into a usable form. Many factors contribute to the time spent getting the raw data dump and also the reverse engineering process. Depending on the time involved, this will determine the final price of this type of recovery.