Flash memory address decoding

Flash memory chips are very different to logical hard drives, or even USB memory sticks.  With a hard drive, acessing sector 0 always takes one to sector 0.  Where the sector is stored on teh disk is actually irrlevant as the disk controller takes care of this.

For a flash memory chip, there is also a controller that takes care of where a sector is stored.  However, this controller is also the interface to the USB port  and can fail.  The solution then is to remove the flash memory chip (with a hot air gun) and read the data directly.  By missing out the flash controller chip, it is often possible to read data on the memory chip - BUT the flash controller chip has to be emulated.

Flash memory in some respects is a compromise as there are limitations on how it can be written and read.  Data can only be read in blocks, often equivalent to 8 or 16 sectors and it is best to districute where the data is written on the chip.  Blocks can fail, so have to be remapped, and they can also wear out.  Another aspect is that before a block can be overwitten it has to be cleared down, so writing can be a two stage process, and hence slower than reading.

The flash controller chip controls all of the above and has methods to obtain optimum performance.  This involves storing the data in areas that do not physically relate to the logical address.  When recovering data it is necessary to decode this mapping . This  blog entry describes one useful method that uses CnW to help.

Most memory chips are part of a FAT controller system.  The problem to solve is to determine where blocks of data are stored.  The solution described is ony a small part of the whole process but one that can help considerably.  If the start of a memory device can be created, then the basic disk parameters can be determined, eg cluster size and address of cluster 2.  The memory (working with a disk image) can be scanned using search for Directory Stubs and this will produce a log of file names and logical addresses.  The same memory image can now be carved, and this will produce some valid files, often JPEGs that will be validated and have a valid date and length.

The clever bit now is to find a file that has been carved, and also read, by matching the file length exactly.  This will then give the logical address from the directory scan and the physical address from the carving.  If different, then the mapping is wrong, but you can see how far out the mapping is, and hopefully work out why.