Logical image reconstruction
When physical image of chip extracted to file it’s stored in “Physical image” element.
In this case pendrive had one NAND chip that consisted of one crystal.
At beginning of analysis it’s necessary to describe structure of NAND physical image. It helps to visualize patterns and determine parameters such as Block size, Page size, Page structure, Spare area structure. The Dump Viewer tool helps to do that. It contains set of special modes, such as Hex Viewer, Bitmap Viewer, Structure Viewer and Record Viewer. In Bitmap mode possible to figure out virtual Block size, Page size, Page structure, Spare Area structure, etc. One horizontal line is one Page. All pages grouped into Blocks which are represented vertically. Every virtual block has unique Logical Block Number marker (LBN) in Spare Area of the page. LBN markers look like vertical pattern in bitmap. When pattern (columns) changes then next block begins. In this case Virtual block consists of 256 physical pages.
The virtual block size consists of 256 pages, and page size is 2112 bytes.
So, the virtual Block size equal to 2112 x 256 = 540672 bytes. Add block to structure.
Next level of physical image structure is page.
Page size is predefined in memory chipsettings and is 2112 bytes fr this chip.
One page consists of Data areas (Logical sectors) and Spare area fragments. Normally size of Data area is 512, 1024 or rarely 2048 bytes. The size of Spare area fragment depends on page size and page structure. One page may have 4,8,16,32 logical sectors inside. Bitmap mode helps to determine structure of the page. In this particular case page consists of four Data sectors per 512 bytes and four fragments of Spare area. This page has following structure:
512/16/512/16/512/16/512/16
Data sector = 512 bytes
Spare area fragment = 16 bytes
In Visual NAND Reconstructor possible to assign any color to Data area and Spare area. It makes visual analysis significantly easier.
Detailed analysis of Spare area in Bitmap mode tells the meaning of every byte – Block Header, Logical Block Number (LBN), Logical Page Number (LPN), Block Write Counter, ECC, etc.
The Record viewer synchronized with Heximal viewer visualize logical block distribution by physical address space of NAND chip. All virtual blocks are mixed due to wear leveling and translaion algorithms.
When physical image structure is determined, it’s necessary to find virtual block/page allocation scheme and remove Inversion/Scrambling (XOR) if required. In this case controller used Inversion and Pair (multi-plane virtual block distribution). The Inversion brings back data to normal readable state. The Pair operation reorder pages withing virtual block according to mult-plane interleave scheme (multi-plane block allocation). Both of these opreations can be detected automatically using “data trasformation” and “page allocation” functions from toolbar.
When all data transformations removed and virtual block allocation is determined, next step is to sort virtual blocks in order of logical image. This can be done using LBN markers with special element “markers table”
In market table parameters is neccessary to select Plane structure, Block, Page, Block header, LBN.
When all parameters of element are set next step is to create “Translation table” that shows distribution of virtual blocks in physical memory space (by physical blocks).
When block table is created, the option “Show Table” opens table of virtual blocks for further processing (sorting, filtering, etc..)
Quick look at the LBN markers shows that Spare area is inverted so we have to re-invert it back (because there are too high LBN values when normally Blocks begin from 0000 till 0FFF. This controller did inversion of Data area only, but we inverted both Data and Spare area on previous step. The “Edit markers” option allows to invert LBN, Block header and all other markers.
When Spare area is inverted back we can see normal LBN markers.
Sorting of virtual blocks by LBN arrange them in seqential order, that equals to file system order.
Virual block with LBN marker “1000” contains file system (MBR). It is the first block of logical image. All further blocks follow increasing order 1000,1001,1002…
During virtual block sequence analysis we can see that chain of blocks breaks at some point and next Bank start with LBN 1000,1001,1002…To build logical image we need to use main blocks that have header = 50/43/FF. All other blocks belong to FW blocks, Log blocks, Replacement blocks, Bad blocks, Reserved blocks, etc. Bank size here is 03FF blocks (1024 blocks), so the maximal LBN is 13FF. In the filter we choose which virtual blocks we want to keep to build logical image:
Virtual blocks with LBN (1000-13FF) and header = FF/50/43
When virtual blocks sorted and filtered it’s necessary to connect “Arrange blocks” element to source-dump (Pair) and Markers table, and create a list of sorted blocks. This element contains logical image with file system. Every page in this image contains Data area and Spare area. On the next step it’s neccessary to cut Spare area off and keep just Data area.
The Data area element cuts Spare area fragmets and keeps Data area only.
Open File System viewer on the Data area element to check file system
In VNR it’s possibly to open and browse different objects such as File System viewer and Block translator at same time. It’s very useful when file system corrupted and helps to find wrong block. The logical image contains lot of corrupted data marked red, which means there’s something wrong in the block sequence. There are two typical problems: duplicated blocks (same LBN) and missing blocks (lost due to failure). All duplicated blocks have been filtered by Header on the previous step.
Another problem is missing blocks. LBN chain integrity shows that there’s missing block with LBN = 11D9 between two blocks 11D8 and 11DA. All data fter block 11D8 is shifted and corrupted.
Add empty virtual block to fix the issue and shift data back to its real place.
All blocks checked, no missing/duplicated blocks remained in logical image. The user data looks much better with no corruptions. It’s time to save user data!
