During the NAND chip reading process, there are internal noise and interference occur, which results in bit errors and data corruption. This problem is particularly critical for TLC flash chips. If a physical image extracted with a high number of bit errors, the correction through the Error Correction Code, that stored in the Spare area of a page, is impossible. Most of the data becomes damaged and recovery is not possible.
Below is the picture of one data sector filled with zeros 0x00 (blank NAND chip stores 0xFF). Left picture – sector corrupted by bit errors in NAND, right – good sector corrected through ECC.
Our researches experimentally proved, that lowering the power of NAND memory it’s possible to reduce the internal noise of NAND and read it with less bit errors (remained errors can be corrected using ECC). For many contemporary chips, a significant reduction of bit errors notably when voltage lowered to 2.5 … 1.8V. The voltage level should be adjusted experimentally, starting at standard 3.3V and going down to the limit.
When too low power is applied, NAND chip or reader may hang (the reader may turn on red led and must be replugged). In this case, power must be increased on one step.
To check the number of bit errors the NAND direct access mode is used. Use default NAND chip power 3.3V and turn the reader’s power ON.
Evaluation of bit errors made in the Bitmap viewer. Open Dump viewer and enable Bitmap viewer on the Reader element.
Browse dump of the NAND chip vertically until some blocks with data appear.
Scroll dump horizontally until you find the Spare area, that looks like a vertical pattern, that being changed from block to block. Spare area is usually located after the first 512 or 1024 bytes in the page, or at the end of the page.
The pictures below show how the Spare area should look like when the noise level is acceptable (acceptable bit error rate) and high noise level (unacceptable bit error rate). Those small “bad pixels” or contaminations on vertical lines are bit errors.
Acceptable noise level
High noise level
In case if there are not many errors with standard power level 3.3V, voltage adjustment is not required. If the level of noise too high, the power must be lowered through chip config in reader element, then power ON again.
If errors still persist but less, the power must be lowered step down. Check errors again, until they disappear or minimized. Normally, the range of power when “bad” chip produces less errors is 1.8-2.5V, but it must be detected experimentally. Go as low as possible, until chip or reader hangs. If the reader hangs – red light appears – reconneсt it. If chip hangs – the bitmap shows artifacts or white empty space – increase power one step up.
High level of noise/bit errors at 3,3V
Lower, but still high noise level at 2,3V
Acceptable noise level at 1,8V
Binary patterns in NAND flash memory
Analysis and recognition of binary patterns in NAND flash memory is the key step in chip-off data recovery and digital forensic analysis of broken flash devices. This analysis is carried out in the Bitmap mode since the classic HEX view does not ...
ECC in NAND flash memory
All modern flash storage devices have a problem with data integrity caused by a poor quality of the NAND chips. This problem is well known as “Bit errors”. When bit errors appear within the area where file is stored, it gets corrupted and unreadable. ...
NAND Bad Columns analysis and removal
Every crystal of modern NAND chip consists of several planes. Typically, it consists of 2 or 4 planes. The plane consists of an array of memory cells grouped into pages and blocks. Planes are connected so that Plane 0 is composed of even physical ...
NAND Bad Columns. Bad Column Remover
Each time during the chip-off data recovery, after the physical image extraction, and before any further step, it's necessary to check the quality of the dump. Due that memory chips are being read physically, the extracted dump may contain defects. ...
Page structure analysis
The user’s data is written into NAND memory page by page. The page size is a physical constant parameter of particular memory chip that can’t be changed (usually ~0.5-16kb). The user’s data is usually sliced into small chunks (512;1024;2048 bytes) ...