Data recovery from monolith flash drives

Flash drives to our laboratory for data recovery bring almost daily. However, in recent years, more and more began to bring miniature, parsing which turns out to be a special construction design - Monolith.



In the circle of repairmen, we called such a performance of the body "monolith". Due to the fact that the controller microcircuit and the NAND memory microcircuit are made in a “one bottle”.
')

Such a constructive touched not only USB flash drives, but also SD memory cards, and of course MicroSD.



Manufacturers of flash drives can be understood - stylish, glamorous, miniature, but ...

Data recovery from such flash drives is very, very problematic.

Usually, either the controller burns on flash drives or the memory cells partially wear out. For any malfunction, memory access is required directly.
Data recovery from a conventional flash drive is performed by soldering the chip, reading it on a programmer that supports NAND, and then assembling the contents. The assembly is called, because the data there does not lie in an explicit form, they are scattered throughout the chip by the controller algorithm.
Data controller scatters "pieces" for uniform wear of the flash drive. There are a great number of controllers and their firmware, the algorithms and sizes of the “pieces” are different. The specialist and / or software analyzes the data, understanding the algorithm can collect the scattered "beads" in the desired sequence and voila, the data is restored.

But you don’t fix anything with a monolith ... Chief, what to do?

We take dremel and goy's pasta, we polish a layer of varnish from the “belly” of the flash drive, it is better to do this under a microscope for close monitoring, so as not to overdo it. Some comrades rub sandpaper or a scalpel, but there is a danger of damaging necessary and valuable tracks with contacts.



I use a domestic MBS-10 microscope and a Weller LT 1L 0.25mm sting., Wires from 0.2 to 0.5mm in a varnish.

Here we solder to the roads.



Here to the footers.



And here comes the first nuance: How do we know where to solder?
NAND is NAND, flash manufacturers: Samsung, Hynix, Micron, Intel and others, post data protection on chips in conventional cases (TSOP, BGA), there are contacts, where the data bus, control signals, “pithos”, ground ... In all normal NAND pins are standardized, but the most important thing is that there (in PDP) there are signal level diagrams, and this is what we need.
We use a logic analyzer to catch the points we need by comparing them with the manufacturer's datasheet. We have a 500Mg 35 channel logic analyzer in our lab. Occupation is very dreary.
But the main problem for working with a logic analyzer is to find the same working flash drive. There is little to be found on the corpse, since it almost does not respond.
The nuance of the second: Sometimes not all contacts on the "belly"!
Yes, not all monoliths required for data recovery contacts are displayed on the upper layer. Puff textolite .... Where is there in the depths of the flash drive contacts the chef ??

X-rays will save us.





When examining the layers under X-ray, you can see where you need to grind the layers, in what place.



Find contacts, solder, and then expand as necessary, as with a regular flash drive.

Summary.

Recovering data from a monolith is more expensive, longer, more difficult than with a regular flash drive.

PS This is the first post of the corporate blog www.datalabs.ru , I hope for a healthy criticism of habravchan ...