It’s been many years since the first NAND controllers were released on the market. Many technological aspects of flash devices have changed since that time, but one thing is certain, along with the multiplied capacity, the quality of data inside NAND chips has been decreased significantly.
Therefore, controllers are using many sophisticated functions to protect stored data. We can observe these results during our daily work, many steps have to be applied before data will be recovered and almost every operation, we reverse, is applied to protect user data as well as possible.
In this article, we would like to bring closer SLC blocks topic and present to you the solution for Phison controllers which are using double rotation mode.
How to recognize that controller uses double rotation?
How to reverse this type of rotation?
How to pull out data from the SLC block?
All this information you will find in this article.
the example below we have a dump from a micro SD
card equipped with a Phison controller. We’ve used static rotation,
but despite, that the rotation element is attached, we could not access
the file system.
Block with LBN 0000 has MBR signature (55AA) on the bytes position [510,511], the same signature has block 0010, it has a boot sector and contains a part of the FAT table and this particular block can be used as the first one, so the beginning of the logical image.
particular block also has a very specific pattern,
we can say it has “stripes” in fact these are alternating pages
with data and empty ones(0xFF). This is the so-called “SLC block” of
MLC memory and only SLC pages are used by the controller. Pages without data, so MLC
ones should be simply filtered out.
filter out empty pages VNR has a built-in tool
inside the Markers Table element called “Page filter”, to use
this option it is necessary to click the “PF” icon and input the appropriate
When the formula has been added in the Markers table new
column will appear and it will be necessary to tick all SLC blocks on
which filter should be applied.
Let’s back to the page filter formula.
Numbers in the formula should be precise in Hexadecimal values plus two key marks “W” and “S”.
Formula W2/S2(W2/S4)3F/S2 means:
Write/Take 2 pages, skip 2 pages, (write 2 pages, skip 4 pages) *63, skip 2 pages.
The important thing- the formula depends on the Chip and controller
Page filter can extract necessary pages and here is an example of how it works:
In this case, even if we have used the page filter, the file structure is still unavailable:
After scanning the logical image by file carver we still have damaged files, despite the use of the block rotation element.
First of all, we should separate SLC blocks. For this purpose, we can use the Markers table, with selected SLC blocks only, and connect the Arranger element.
The second markers table should contain only normal blocks, so non-SLC blocks.
These blocks should be sorted and their LBN chain should be fixed, so we shouldn’t have any duplicated blocks and afterward, it’s necessary to insert missing blocks, so the same approach for Markers table like for the other simple cases.
The number of selected blocks in the Markers table has to be divisible by 4, otherwise, it may not be possible to apply further operations. The number of blocks can be checked in the Markers table, check block Position.
So the last block from the first block table was 0017, and in this block table, the first one will be 0018.
The last block should be XXX3, XXX7, XXXB, XXXF. That rule can help us to get the number of blocks divided by 4.
When all data blocks are inside the arranger, it is necessary to make the offsets, and rule how to do this is not difficult. There are groups of four blocks.
how it presents in the case:
In the next step, it is necessary to concatenate offsets by parameters.
The last block from every group is divided by three and those small chunks
are added to the first three blocks in the group:
most important are Area sizes:
In the next step, SLC blocks should be joined with the other remaining blocks. For this purpose, the additional concatenate element should be used. Click on the bulb icon to extract area sizes. So then two dumps will be joined by whole sizes one after another like a simple JBOD.
It is a very complicated case to solve, but that kind of solution we
have found only with one ID, and now there is a faster way to solve it,
all that is necessary to do is check this ID in database "Devices".
The next step is to open the Devices Database:
If there is the same device in the database, we can load the solution to the case:
After that operation, all elements are inside the Workspace, after that it is good to remove the repeated elements and then to connect graph elements.
In the attached graphs there are also notifications with instructions to
Sometimes, if there are two Banks, it is necessary to check the “Auto”
flag and after that add 2 banks:
If all conditions are met, then the first parametric concatenate works
The second Concatenate is a simple concatenate by full areas, so it is necessary to just click the “bulb”. Then the fully recovered logical image will be in the Data area: