Memory Stick Data Recovery due to failed ECC
A memory stick was received by a customer reporting that whilst it was being detected by her Apple Mac computer with the correct capacity, no data was accessible. To begin with, we assumed that the filesystem had become corrupt and that most likely the memory stick still had reasonable functionality. In most cases where the processor/firmware of a memory stick fails the device will either not be detected at all, or shall be detected with the incorrect capacity.
The data keeps changing after each read attempt
On receipt of the device, the fault was one which is far less common. On initial inspection of the raw data in hexadecimal format there looked to be reasonable data, with intact file headers. However, on closer inspection is appeared that there were incorrect values. Moreover, when the memory stick was powered off, then on again, some of the values within the data would change. The screenshot below in WinHex shows this.
Different data in the same block after power off/on. This is due to failed error control correction (ECC) in the memory stick.
Whilst the changes shown above might seem minor, these are enough to prevent the files from working normally.
Failed Error Control Correction
Error Control Correction (ECC) is necessary for all flash NAND based storage (e.g. memory sticks, solid states disks etc). This is because the NAND chip which contains data is inherently unreliable. When data is written to NAND Flash, an ECC is logged and stored with the data (usually in the out-of-band region). At the point when the data is read back, the ECC is recalculated and analysed against that already stored in the flash NAND.
Any error is a sign of bit error in the data stored. By further looking at the inconsistencies between the ECCs, the device can distinguish and alter any bit errors in the data.
Often, the NAND controller performs error correction and detection in hardware by operating on the ECC fields in the OOB area. In this case, the NAND controller of the memory stick had failed in such a way so that ECC was no longer applied successfully.
Schematic showing NAND layout with out-of-bound (OOB) area.
Details of the memory stick which failed:
- 32GB Verbatim Memory Stick
- NAND Chip Marking: DFT0128GWD8H1GT
- Processor: DM8325AL-01
Chip-off data recovery
It was necessary to physically dismount both of the flash NAND chips from the printed circuit board. These were cleaned, then read directly. The raw dumps of data were then handled in PC3000 where error control correction (ECC) was manually applied. The appropriate XOR and page transformations were made. It was possible to make a recovery of the majority of the data. A small number of files were corrupt due to uncorrectable read errors in the NAND.