Today we will discuss typical data recovery techniques for recovering data from physically defective USB Flash Drives, also referred to as Thumb Drives, Flash Sticks, USB Sticks, USB Pens, or Memory Sticks. This Toronto based blog will not discuss the situations in which the USB flash stick is still operational.
The typical USB flash drive is made up of two main components: the actual memory chip or IC (integrated circuit) and the controller chip or IC. In the diagram below we can see a typical USB Flash stick taken apart to reveal the two main components. In many instances there will be an additional memory chip on the other side of the PCB or printed circuit board.
Inside a typical Flash Drive
There are two basic approaches to recovering the data from an inoperative or inaccessible USB flash drive. Which approach we use is decided largely on whether the data on the memory chips is encrypted or not. Unbeknownst to the average Joe, encryption is often being implemented on USB sticks automatically and invisibly. We see this use of automatic encryption becoming more and more common. Over the years we have learned to identify many of the flash devices that use encryption but it will always be an ongoing process as the sheer magnitude of new devices being introduced is staggering.
If there is no encryption present, we can physically desolder and remove the individual memory chip(s). These chips can then be read in a specialized chip reader and their contents dumped to a file(s). Now the work begins as the data read from the chips is a very raw dump of every bit of data from the memory chips. The problem with flash is that there may be many copies of the same or almost the same data present on many data cells across the drive as a result of “Wear Leveling”. Wear leveling is where the Flash’s controller attempts to ensure equal wear of each data cell to ensure the device lasts as long as possible with no unreadable areas. Furthermore the controller has access to additional hidden data cells (10-15% above the advertised capacity) that can be used for relocating the data from questionable cells. So the big problem is determining which cells are active, which have been remapped and in which order do the active cells belong. And of course the market is new and there presently exists hundreds of manufactures all doing things just slightly differently. If we haven’t already reverse engineered a particular flash device and it’s storage techniques, we can spend literally days figuring it out. Of course, next time we come across that exact device it will be easy .. but the majority of the cases we see are unique!
Alternatively if we suspect that the controller chip is bad and we are able to source an exact same controller, we can simply replace the defective controller and gain access to the device. But finding the correct controller is often impossible as USB flash devices become obsolete over night and the innards of two identical flash devices are often quite different.
If encryption is present it does no good to simply read off the memory chips as the data will still be encrypted. In these cases, we must repair the flash device (replace controller or other discrete components) OR source an exact replacement USB flash drive and then xplant the memory chips onto it.
Regardless of what technique we use, if you require Toronto USB data recovery on a physically defective Flash Drive it can be time consuming and relatively expensive. Be prepared, be secure, and ensure your USB Flash device is always backed up.
© 2012, David Foster. All rights reserved.
Tags: data recovery toronto, Flash drive data recovery, thumb drive data recovery, toronto data recovery, Toronto flash recovery, toronto usb recovery, USB data recovery, USB flash recovery, USB recovery toronto
Linking to this article, thanks!