“Real” raw access of flash memory cards?

09
2013-08
  • Wolfram

    I have a 16GB microSDHC card that apparently was nuked by the phone (a friend's phone, not sure which, but I can find out): while taking pictures, it suddenly could no longer access/recognize the card. I was with her when it happened. We immediately switched off the phone, and didn't try to format the card or anything.

    Using an SD-CardReader and Ubuntu, the device could still be recognized, and the complete 16GB could be read via dd without errors. However, 99% of the dd-dump were just zerobytes, although the card previously contained several GB of data. Only a very small fraction still contained data, and these fragments were scattered throughout the 16GB.

    For example, the card originally contained a FAT32 file system. However, now the boot sector and partition table were zeroed out, as well as the first FAT copy, and most of the data. Curiously, the 2nd FAT copy was intact, as well as the root directory. I found (only) three partial JPGs in the dd-dump, and the interesting thing is the Exif-data from these JPGs suggests they were taken just before the card crashed.

    So my questions are as follows:

    • Instead of using dd, which relies on the Linux usb mass storage drivers recognizing (and interpreting) the device, is there some other way to access even lower levels of information of the flash card (i.e., truly reading out the chip contents, instead of what usb_storage sees? Some form of FTL, JFFS etc.?)?
    • Was the data truly erased, or just tagged as "dirty" somewhere? It would be physically impossible for a phone to really overwrite 16GB of memory within seconds. So maybe there is a way to read out the real data ? Or is this generally only possible by dismantling the card and directly accessing the NAND(?)-device via specialized hardware?

    I'd appreciate any pointers whatsoever - as my friend isn't really using computers beside her phone, she never bothered to ever copy any images from it to a safer place, so several hundred photos of friends&family would be lost :-/

  • Answers
  • Marcel Stör

    I don't really have a clue as to the real problem here but I've got a recommendation. The other day my wife switched on our digicam and was told it couldn't access the sd card inside. I tried inserting the card into my MacBook - wasn't recognized. Then I tried with the old XP PC and a card reader - same result.

    After searching the Internet I came across http://recoverfab.com/. Sent the card there by mail, got receipt confirmation three days later and recovery confirmation another three days later. Worked a charm.


  • Related Question

    usb - Copying SD Cards with "LaCie d2 Network"
  • rjstelling

    The LaCie d2 Network has a feature where by you can attach a USB drive and press the blue button at the from and it will copy the drive contents (no computer required). (See this review for more info).

    USB 2.0 and eSATA ports are also provided but these are not designed for extending the d2 Network's storage. Rather, they allow you to connect portable drives for uploading their data to the d2 Network directly. The process is quite slick, too: just plug in a drive and press the big blue button on the front of the unit to trigger an immediate upload. This copies over everything on the external device and seems ideal for camera use.

    LaCie d2 Network

    Is it possible to use an microSD or SD card adapter (like the Kingston MobileLite 9-in-1) and copy the contents of the card?

    I'm assuming the card reader just "looks like" a normal USB flash drive the computer or (in this case) LaCie d2 Network.

    Is this assumption correct? Do you know any reason why this won't work?


  • Related Answers
  • Michael Kohne

    This is going to vary somewhat. I have a multi-card reader and it actually shows up as 4 separate drives on Windows, one of which has the card you plugged in. I have no idea what the LaCie would do with that. You'd probably have your best luck with a single-format reader, as that is least likely to have oddities that would confuse the drive.

    Basically: You're gonna have to buy one and test it, if you want to find out.