Preparing Device for Research
In NAND data recovery, there are many types of devices, which means many different ways to extract data.
Sometimes a device has no ready-made solution because the XOR, ECC code, or data translation method is unknown. Research becomes extremely difficult if the device is dead.
The best way to create a solution for such devices is to find a working donor device.
Preparing the Donor Device
If the device is not new, it is recommended to format it using FAT32 (or exFAT for devices larger than 32GB). The format must be full, not quick, to ensure all old data is erased.
After formatting, write some sample files to the device. JPEG and DOC files are usually enough for research, but adding more formats like MP4, MOV, or PDF can be helpful.
Sometimes a device has no ready-made solution because the XOR, ECC code, or data translation method is unknown. Research becomes extremely difficult if the device is dead.
The best way to create a solution for such devices is to find a working donor device.
Preparing the Donor Device
If the device is not new, it is recommended to format it using FAT32 (or exFAT for devices larger than 32GB). The format must be full, not quick, to ensure all old data is erased.
After formatting, write some sample files to the device. JPEG and DOC files are usually enough for research, but adding more formats like MP4, MOV, or PDF can be helpful.
The Pattern Writer Tool
In the software plugins, there is a tool called Pattern Writer.
It can write zeroes, patterns, or counters.
picture 01. The Pattern writer location.
It is also possible to save a counter, zeroes or patterns directly to the device, which helps during research, but this method is more advanced.
picture 02. Saving data directly on the device
This article describes a simple way to create universal sample files for research, instead of writing patterns or counters directly to the device.
In the Pattern Writer tool, there is a “Binary file” option. This allows saving patterns or counters into files.
picture 03. Binary file option
Setting the File Size
The next step is to define the size of the binary file.
In the Range field, set:
From = 0 (start position).
To = file size.
For devices under 32GB, 1GB files are usually enough. For larger devices, it is better to create 10GB or 16GB files.
File size calculation:
1GB = 1024 × 1024 × 1024 = 1,073,741,824 Bytes
10GB = 10 × 1GB = 10,737,418,240 Bytes
16GB = 16 × 1GB = 17,179,869,184 Bytes
picture 04. 1GB file size setting
Zeroes Binary File
A zero-filled binary file is very useful. It helps in analyzing XOR generation.
Creating the file is simple: just click the button, select the location, and name the file.
picture 05. Button to save 0x00 binary files
Pattern 0x77 File
Some controllers work in a specific way. Instead of writing zeroes, the controller only saves information about their location and length. In such cases, XOR may not be visible after dumping.
To avoid this problem, use a known pattern file. The standard pattern is 0x77.
Creating this file is also simple: set the size and click the save button.
Some controllers work in a specific way. Instead of writing zeroes, the controller only saves information about their location and length. In such cases, XOR may not be visible after dumping.
To avoid this problem, use a known pattern file. The standard pattern is 0x77.
Creating this file is also simple: set the size and click the save button.
picture 06. Button to save 0x77 binary files
picture 07. 0x77 pattern in the de-XORed dump
Counter File
A counter file helps analyze data allocation, which is useful for rebuilding files from the dump.
Steps to create a counter file:
Page size – This is not the NAND page size, but the increment step for the counter. A universal value is 512 Bytes.
Increment period – Select “PAGE”. With 512B page size, the counter increases every 512 Bytes.
picture 08. step 1. Page size 512B, step 2. increment period: PAGE
Add text – Adding text to the counter helps to locate it after de-XORing.
Repeat period – Set the same value as page size (e.g., 512B). This places the text next to every counter number.
picture 09. step 3. Text, step 4. Repeat period 512 Bytes (same as Page size)
Save the file – Click the button and save the counter as a binary file.
picture 10. step 5. click the button and save counter into file
picture 11. Counter in the de-XORed dump
After these operations, you will have three universal files for preparing the device for research:
Zeroes binary file
Pattern 0x77 file
Counter file
picture 12. Sample files for writing into device for research
Sample Files to download:
1GB_0x00
1GB_0x77
1GB_Counter_by_512B
These files can be used directly for testing and research
Conclusion
Proper preparation of a donor device is a key step in NAND research and data recovery.
By creating and using zero, pattern, and counter files, you can:
Analyze XOR generation
Detect how controllers handle data
Understand data allocation patterns
This method provides a universal, repeatable approach for preparing any donor device, making the research process faster, more structured, and more effective.
Thank you for reading!
Lukasz Pietrzykowski, Rusolut Team
Related Articles
Binary patterns in NAND flash memory
Analysis and recognition of binary patterns in NAND flash memory is the key step in chip-off data recovery and digital forensic analysis of broken flash devices. This analysis is carried out in the Bitmap mode since the classic HEX view does not ...ECC in NAND flash memory
All modern flash storage devices have a problem with data integrity caused by a poor quality of the NAND chips. This problem is well known as “Bit errors”. When bit errors appear within the area where file is stored, it gets corrupted and unreadable. ...Silicon Motion(SM) controllers - Data recovery
We can find plenty of NAND controllers on the market and without any doubt one of the most popular is SiliconMotion. These controllers found their use in all kinds of flash devices, starting from USB flash drives, SD cards, monolithic devices, and ...Flash Drive Data Recovery educational webinars
Chip-off NAND data recovery with Visual NAND reconstructor consists of several essential steps whose task is to reverse transformations which controller applied on user data. In those education webinars, you will find out how to extract raw dumps ...Alcor Micro(AU) controllers - Peculiarities of data recovery
Alcor Micro (AU) controllers are found in all sorts of devices such as microSD cards, USB flash drives, SD cards of any package, and especially monolithic devices. They are very popular in cheap, refurbished, and fake devices as well. Recent models ...