We receive dozens of flash cases every week and our clients often ask us why is it so complicated to recover data from their flash device. Flash devices don’t store data like a hard drive, the controller (brain) of the flash device transforms data as it passes through it. Each transformation the flash drive makes to the data has to be reversed engineered, step by step. Some the most complicated transformations implemented are XOR and Encryption.
XOR
9/10 flash drives we encounter use a XOR or almost all modern flash-based device. When data is “Xor’d”, it scrambles the raw data that is stored on the NAND chips. This technique helps prevent memory degradation and increases the reliability of the device by converting the data into data that looks like a white noise pattern. XOR can be thought of like a light encryption with the main difference being XOR keys are not unique or require any private\public key to reveal the original data.
Multiple USB drives using the same controller can also utilize the same Xor key. This makes reverse engineering the XOR possible by locating the key inside the data dump or using a working similar device to create recognizable patterns to help extract the key. We have extracted and collected hundreds of Xor keys from all different flash devices and are working daily to extract new keys.
Encryption
A small percentage of the devices we receive (such as older Sandisk USB drives) use actual AES encryption at the controller level. This encryption uses a unique key for every device that is stored in the controller and encrypts all data that is written to memory. When a drive uses encryption, we cannot perform a chip off to achieve a successful recovery since there is no way to decrypt the dumped data. In these cases, the solution has to be to repair the device (faulty capacitor, broken connector, loose connection to NAND chip). Unfortunately, if the device has corrupt firmware or too many bad cells in the NAND die, recovery will not be possible.
If you have experienced data loss on USB Flash, need SD data recovery or SM, Memory Stick, CompactFlash, MMC memory card data recovery our engineers can help. Data Analyzers engineers are also able to recover solid state drives that have failed.
