Lifetime warranty conditions
- Lifetime warranty is available for VNR Reader only
- Lifetime warranty is granted for users with Premium Support subscription
- Lifetime warranty is granted only if the interval between the end and the extention of Premium Support subscription does not exceed 1 month
- Lifetime warranty does not cover mechanic or intentional damages
Visual Nand Reconstructor has a large database of different resources such as NAND chip configs, Scrambler patterns (XOR keys), monolithic chip pinouts, solutions for devices, etc. It is regularly updated and available for users subscribed to Premium support in Client Portal
VNR can be re-installed and re-activated on different machines as many times as you need. Please, note, daily limit of activation is 3 times due to security policy.
In our Blog you can find a new techniques and starte-of-art technologies of data recovery and digital forensics of flash storage devices.
- Personal help
- Lifetime warranty
- Software updates
- Database update
- Lifetime activation
- Annual fee
- 600 €
Can I retrieve data from physically broken Flash devices using VNR?
Yes. VNR is a tool that can recover data from physically broken flash storage devices as long as memory chip is not destructed. In about 95% of all cases with non-recognizable flash devices there’s no damage to NAND chip occur.
Does VNR support automatic data recovery?
Visual Nand Reconstructor has automatic analysis modes, database of devices and very powerful manual modes of physical image analysis.
I've heard that even formatted Flash drive still contains some user data in special area, can I see this via VNR?
Yes, it’s true. This “breach” caused by limited lifespan of NAND memory when program/erase cycles causes memory cell degradation in couple with specific garbage collection algorithm. Modern controllers do never overwrite data in the same place (block/page) as long as NAND chip has free blocks. They move updated data to the new block/page and leave obsolete block with “garbage” for garbage collection algorithm. It doesn’t start to work (to erase) blocks immediately. It causes known issue, when you wipe data on flash device, it still keeps it for some time. VNR allows you to analyze all blocks of NAND chip and find these old blocks/pages, if they kept.
I need a tool for chip-off digital forensics
Visual Nand Reconstructor is a tool that allows to extract physical image of data from NAND chip and transform raw data to logical image. This can be used for data recovery and digital forensic procedures. Also it has a special modes for obsolete/erased block analysis.
How do I recover data from microSD cards?
I found many flash devices have monolithic chips. Can I handle them in VNR?
Yes. There’s special adapter “Monolith” in Visual Nand Reconstructor kit that allows to connect any monolithiс chip to reader. In VNR you can find a dabatase of monolithic chip pinouts for USB Flash drives, MicroSD, SD, etc. This database is constantly updated.
Some Toshiba and Samsung chips have lot of bit errors when I read them in other readers, is there anything in VNR to help read it?
Due to power consumption trend all new chips work in power range 1.8V…3.3V. When you read the chip with standard power 3.3V it produces lot of bit errors that lead to unrecoverable data corruption, even ECC can’t fix all errors. The Visual Nand Reconstructor allows you to change power of core/ports to 1.8V that helps to reduce errors significantly! You can see here proving experiment. The VNR reader can supply 1.8V…4.0V to NAND chip so there’s a big room for experiments with chip configuration and power adjustment.
I receive Tablets and Smartphones for digital forensics and physical data recovery, does VNR tool support it?
Yes, VNR supports most of known NAND chips. Most of Tablets have standard NAND chips, however some smartphones use different chips which we’re analyzing as soon as they appear. Using Visual Nand Reconstructor you can extract the physical image (dump) of chip, separate data/spare area of image for further processing.
As I know modern chips have lot of problems with data scrambling (XOR), so data recovery is impossible?
Scrambling is not encryption, so XOR key is not unique and can be extracted then applied through several ways:
1. VNR built-in database of XOR keys
2. XOR key extraction from client’s physical image via Bitmap mode
3. XOR key extraction from donor drive filled with pattern
I need a tool for data recovery and analysis of broken Digital Voice Recorders, can I do it in Visual Nand Reconstructor?
Yes. The digital voice recorders use NAND memory for storing data, and have same principles of data allocation as other flash media.
How about Sandisk support?
Some of their controllers use data encryption, some scrambling (XOR) which we support for particular models. Another peculiarity of these devices is that they mostly use 16-bit NAND chips. VNR reader supports 8-bit and 16-bit data bus of NAND chips.
The reader has pictures of the adapters, some of them do not have sockets. Will you be providing adapters with sockets for all the type of NAND chips your reader can read, ie. BGA60, BGA100, BGA152, BGA154 and BGA224.
All the adapters that you see in specification are included into VNR kit. We’re developing new adapters with ZIF sockets for chips you mentioned (and some others), but they will be sold separately as an option. The BGA60 chip can be read in TLGA52 adapter from Visual Nand Reconstructor kit.
You mention that VNR supports reverse engineering of new controllers, what exactly is this, how does it work ?
We proudly say that we do not have “engineering version” of Visual Nand Reconstructor or any other special addons for reverse egineerging of new devices. Our developers and engineers use the SAME version of VNR as you buy, for R&D of new devices. When you buy VNR what you get is not just software for image reconstruction with set of scripts, but a powerful and extremely flexible platform for digital forensics, data recovery and reverse engineering of flash devices. You can extract scrambling patterns (aka “XOR keys”), discover FTL algorithms of old and new controllers, find obsolete data in special blocks, analyze LOG blocks (history of file system modification and some other “hot” data), analyze firmware blocks of contoller, and whatever you need or may not even expect The Visual Nand Reconstruction is the MOST POWERFUL PLATFORM on the market for NAND recovery/forensics/researches and it is two steps ahead of all existing tools by functionality.
Do you have a database with list of NAND chips / controllers, that are recoverable with your tool?
Supported data storage devices
USB Flash disks, Solid State Drives, SD cards, Monolithic flash media, Micro SD cards, MS cards, XD cards, Digital voice recorders, MP3 players, Tablets, Smartphones and other NAND based data storage devices.
Alcor Micro (AU), Innostor (IS), Jmicron (JMF), Indilinx (IDX), ITE (IT), Lexar (FC), Phison (PS), Samsung, Sandisk, Silicon Motion (SM), Skymedi (SK), Solid State Systems (SSS), Stec, Toshiba (TC), USBest (UT), others.
Supported NAND memory
Micron (2Ch), Intel (89h), Toshiba (98h), Sandisk (45h), Hynix (ADh), Samsung (ECh), others ONFI and non-standard.
Can I use dumps (NAND physical images) from other tools?
Yes, you can load any dumps to “Physical image” elements and reconstruct the logical image in VNR.
What differs VNR from other data recovery tools?
– Innovative approach to data recovery and visualization of data patterns
– Scrambler pattern (XOR key) extraction mode
– Unified block translator algorithm
– Universal gold plated socket of reader allows to connect any existing and future chips easily
– Power adjustment capability helps to reduce the noise and minimize bit errors when reading chips
– Reprogrammable reader’s logics allows to load new chip config fast and test unknown chips
– The largest set of adapters among data recovery tools
– Universal Monolith adapter
Installation & activation
Are there any recommended hardware/software configurations for the VNR?
We recommend to use Windows 8/7 x64 for better performance and higher flexibility.
Also the latest Framework and MS SQL Compact server must be downloaded and installed from official Microsoft website.
The VNR works on any modern PC/Laptop.
However we recommend to use:
CPU: Core i7/i5 or similar
RAM: 6GB and higher
HDD: SSD or fast RAID config
Monitor: 19inch and higher
MB: Any with USB 2.0 support and enough RAM slots.
Data analysis/correction/search processes are always very intensive processes for all PC components. Data is read from HDD, loaded to RAM and mathematically analyzed by CPU.
For comfortable work we recommend to use 19inch monitor and higher. When analyzing data in bitmap mode, more pixels means more efficient and faster work.
Visual Nand Reconstructor crashes, how do i fix it?
1. Please, make sure you install the latest version of software and resources available at Client Portal
3. If problem still persist, send email to firstname.lastname@example.org
If the software suddenly crashed you can recover the case from autosaved *.tmpcase file just by renaming it to *.case file. You can change autosave interval in settings.
How to update VNR software?
2. Download the VNR software installation file as well as resources and databases (XOR keys, BCH, etc)
3. Follow install instruction for each component.
How to get login and password to Client Portal?
You have to pass registration. Due to anti-spam policy, we manually check all accounts. All requests are processed within 24 hours.
Is the license locked to the hardware (so can I move it to a different machine if I need to)?
Yes, VNR license locked to the hardware configuration of your computer, however you can move it to another machine with further reactivaton of software.
Are multiple software installations possible? So that we can have one machine reading the chips and another processing a case.
The VNR must be started with connected reader, but as soon as chips are read, it can be disconnected. Plug it back when you want to save user’s data (you can run VNR on second machine and read chips while analyzing another task!)
I can't start VNR, have an error on Windows 7 - "file MSVCR100.dll" is missing
This error usually caused by lack of one OS component. Just install Microsoft Visual C++ 2010 Service Pack 1 Redistributable Package MFC Security Update from official Microsoft website and this problem will disapper.
I installed a new CPU and I am getting "you activation key is binding to another PC"
You must reactivate Visual NAND Reconstructor when configuration of PC has changed. Delete “activation.key” from VNR installaton folder, run application and send new activation request.
Reader doesn't read chip ID
– Make sure that you insert the chip correctly as shown in the quick setup guide (p.8-12)
– If none of suggestions helped, please send the following information to email@example.com:
– high quality photos of chips and PCB (especially pins/pads)
– chip model/marking
NAND chip with my ID is not listed in configuration window
2. Make sure you’ve set all flags in Case/Database menu.
3. If chip with your ID is still not listed, try to delete 2 last symbols of ID in filter.
4. If non of above helped, please, send request to support team.
Let us know:
– NAND chip ID
– marking from the label
– chip capacity (total device capacity / number of NAND chips)
– type of NAND package
When you build the structure, how do you figure out that the data area is 1024 and ECC is 70 ?
It’s based on visual pattern analysis through Bitmap mode. The data, ecc and spare area patterns look different. The main idea is to find the border of patterns inside the page. Here is a library of patterns. Almost all modern devices use 1024b data area size (some old 512b).
Is the "Correct Dump" (BHC functions) button required to be pressed after the "Reread Dump" button is pressed?
No, “Correct dump” feature is used only if you need to apply ECC corrections right into dump. In case of “Reread dump” option it will do that automatically at the very first pass.
When the Check Headers button is pressed in the File System Parser, what is the significance of the grey/green/red flags? Which headers is it checking?
– read flag means file is corrupted and its header mismatches extension
– white flag means that file header is unknown to software
Some recovered file's MD5 hash DO NOT match the original source file's MD5 and others do. Why?
In majority of cases they it be fixed with ECC/BCH algorithms, multiple reread via BCH map (set at least 10 passes) or power adjustment (or all methods together)