Page structure analysis

Page structure analysis

The user’s data is written into NAND memory page by page. The page size is a physical constant parameter of particular memory chip that can’t be changed (usually ~0.5-16kb). The user’s data is usually sliced into small chunks (512;1024;2048 bytes) before it's recorder into page. The page space is used for three different types of content : Data area, Spare area and ECC. The allocation of those areas could be very different depending on the controller model.



The most convenient tool for page layout analysis and assignment is a Bitmap viewer in couple with Structure viewer. The analysis of page layout is based on the pattern analysis. The main goal is to define which area is where, find its size and borders within the page space.


Data area and its size
512 bytes – used in old devices where controllers didn’t use scrambling (XOR), old phones and other devices.
1024 bytes – used in all modern flash devices where data is scrambled (XOR'd). Statistically, 8 out of 10 devices use this data area size nowadays.
2048 bytes – used in most of Sandisk devices.

Spare area
Spare area content vary depending on controller. The most important structures of Spare area that must be found and assigned are:
LBN (Logical Block Number)– 2 bytes, the value changes from block to block, potentially from 0000 to FFFF.
Header (Block header) – 1 byte that describes type of block.

ECC
The ECC area may have any size in a range of 10-240 bytes per data chunk. Every data area chunk is protected by its own piece of ECC code.

The typical patterns of these areas are described in the this article.

Practice
Case  #1
  1. Download the video tutorial
  2. Download the case and examine page structure
  3. Delete internal page structure and try to define it yourself

Case  #2
  1. Download the video tutorial
  2. Download the case and examine page structure
  3. Delete internal page structure and try to define it yourself

Case  #3
  1. Download the video tutorial
  2. Download the case and examine page structure
  3. Delete internal page structure and try to define it yourself


    • Related Articles

    • Multi Plane Page Allocation

      The base element of a NAND memory chip is a crystal and each crystal consist of several physical components: there are peripheral devices which provide I/O operation, page decoding and overall communication between NAND crystal and memory controller. ...
    • NAND Bad Columns analysis and removal

      Every crystal of modern NAND chip consists of several planes. Typically, it consists of 2 or 4 planes. The plane consists of an array of memory cells grouped into pages and blocks. Planes are connected so that Plane 0 is composed of even physical ...
    • Analysis of bit errors in NAND and power adjustment

      During the NAND chip reading process, there are internal noise and interference occur, which results in bit errors and data corruption. This problem is particularly critical for TLC flash chips. If a physical image extracted with a high number of bit ...
    • Binary patterns in NAND flash memory

      Analysis and recognition of binary patterns in NAND flash memory is the key step in chip-off data recovery and digital forensic analysis of broken flash devices. This analysis is carried out in the Bitmap mode since the classic HEX view does not ...
    • Flash Drive Data Recovery educational webinars

      Chip-off NAND data recovery with Visual NAND reconstructor consists of several essential steps whose task is to reverse transformations which controller applied on user data. In those education webinars, you will find out how to extract raw dumps ...