The owner of a small logistics business in Athlone recently contacted us. His business distributes freight from and to Athlone to Dublin, Cork, Galway and Limerick five days a week. Last week the hard drive in his laptop experienced catastrophic failure. However, two weeks previous, he had made a backup of his “My Documents” folder and his Sage accounts file onto his USB stick. He connected his Kingston USB memory stick to his desktop computer but it was not recognised. He got the message “Please insert a disk into drive E”. He believed that the age of his desktop computer was the problem. The following day he bought a new laptop. He connected his USB stick to one of its ports but got the same message. He brought the USB stick to his I.T. support provider so they could examine it. Unfortunately they were not able to retrieve any data from it. They recommended that he contact Drive Rescue.
Once we had received his USB stick, we tried accessing it using our own systems but we got the same error message. The first data recovery step in the data recovery process for this case was the opening up of the drive in our clean room to physically inspect the inside of the device. The PCB tracks and diodes all appeared to be physically okay. We then tested the diodes using a multi-meter. They all appeared to be working. The device was showing all the symptoms of a failed controller. While the NAND chip stores the actual user data. The controller chip stores a software module which contains the ECC and wear-levelling data of the drive. Error Correction Code is an algorithm built into USB memory sticks (and most NAND memory devices) which helps to fix bit errors that occur in the file system during the life of the drive. Meanwhile, the wear-levelling function helps the data to be evenly distributed throughout the memory cells of the device.
We used a hot-air rework station to remove the NAND memory chip from the PCB. This is an intricate and time-consuming job as the temperature has to be hot enough to melt the solder but, not as hot, as to damage the actual memory chip. During the process, it is also important to note whether lead-free solder is used to join the chip to the PCB. Lead-free solder usually requires a higher temperature to remove than a lead-solder joint. Different temperatures will also have to be used depending on chip size the type of PCB. Using our precision tools, experience and a steady pair of hands – we successfully removed the NAND memory chip from its PCB.
In order to read the data from the extracted NAND chip, we would need the exact controller information as used on the original USB for our emulator. While the controller chips on USB sticks are usually easy to spot; their exact model number is sometimes hard to identify because often you will only find a part number on them and a manufacturer logo on them. Common controller chips found on USB memory sticks including those from manufacturers such as ALCOR, KTC, Silicon Motion, Ramos, Phison, OTI, SMI and SSS. In this case, the controller being using was an SSS (Solid State System) with model number 6692.
Once the exact controller module had been uploaded to our emulator, we determined the memory block sizes and erase block sizes of the data. After some manual reconstruction of the FAT32 file system using a hex-editor we were finally able to see the client’s data. We recovered all of his Sage 50 accounts file, along with all of his Word, Excel and scanned document folders. For the client’s piece of mind, we invited him to log into our systems remotely to view his recovered files. Everything that he needed was there. The delighted customer was sent his recovered data on a new USB memory stick – this time, he will be backing up his data to three different places instead of just two.