eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch •...
Transcript of eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch •...
![Page 1: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/1.jpg)
eMMC-NAND RECONSTRUCTOR
Alexander (Sasha) Sheremetov - Rusolut
![Page 2: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/2.jpg)
APPLICATIONS OF EMMC CHIPS IS WIDE
• SMARTPHONES• TABLETS• DRONES• CARS• SATNAV SYSTEMS• WEARABLES/SMARTWATCH• LAPTOPS• VOICE RECORDERS• MULTIMEDIA PLAYERS• TV BOXES• SMART TV• INTERNET OF THINGS
…AND MUCH MORE…
![Page 3: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/3.jpg)
COMMON EMMC/EMCP CHIPS USED IN PHONES AND OTHER DEVICES
BGA221 BGA162 BGA186
BGA169 12x16 BGA153/169 11,5x13 BGA153/169 10x11
BGA169 12x18 BGA169 14x18
![Page 4: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/4.jpg)
INSIDE EMMC
NA
ND
PR
OTO
CO
L
EMM
C P
RO
TOC
OL
CONTROLLER NAND MEMORY
![Page 5: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/5.jpg)
EMMC THROUGH XRAY
CONTROLLER
NAND MEMORY
![Page 6: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/6.jpg)
EMMC - CHIP LAYER
CO
NTR
OLL
ERNAND MEMORY
![Page 7: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/7.jpg)
TECHNOLOGICAL PADS - NAND INTERFACE
![Page 8: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/8.jpg)
WHY CARE ABOUT GETTING PHYSICAL IMAGE THROUGH NAND?
NA
ND
eMM
CeM
MC
• QUICK EXTRACTION• WORKING CHIPS• LOGICAL IMAGE (95-97% OF DATA) • DEEP EXTRACTION OF DELETED DATA
• DATA EXTRACTION EVEN AFTER RESET• DEAD CHIPS• TRUE PHYSICAL IMAGE (100% OF DATA)
eMMC NAND
![Page 9: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/9.jpg)
PAGEPAGE
PAGE
BLOCK
DATA RECOVERY FROM GARBAGE BLOCKS OF NAND
1. READ PAGES2. MODIFY DATA3. PROGRAM (WRITE) PAGES
PAGEPAGE
PAGE
2 - MODIFY DATA
CONTROLLER
NAND MEMORY
PAGEPAGE
PAGE
OLD UNERASED BLOCK STAYS UNTOUCHEDFOR SOME TIME UNTIL GARBAGE COLLECTION ALGORITHM ERASE IT. USUALLY IT’S NOT FAST PROCESS
![Page 10: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/10.jpg)
0005
PHYSICAL IMAGE
0000
0023
005F
....
001E
0007
0005
0000
LOGICAL IMAGE/FILE SYSTEMACTUAL BLOCKS
FRAGMENTS OF DATAGARBAGE/OBSOLETE BLOCKS
0000
0001
0002
0003
….
03FE
03FF
0000
0005
….
????
FILE
S &
UN
ALL
OC
ATE
D S
PAC
E
FRA
GM
ENTS
FO
R C
AR
VIN
G
![Page 11: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/11.jpg)
FROM SEVERAL BLOCKS TO SEVERAL DOZENS
HOW MANY GARBAGE BLOCKS CAN WE FIND IN AVERAGE DUMP?
![Page 12: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/12.jpg)
WHAT CAN/CANNOT BE CARVED FROM THE FRAGMENTS, REALISTICALLY
GARBAGE/OBSOLETE BLOCKS
0000
0005
….
????
SIZE OF SEQUENTIAL CHUNKS OF DATA VARIES FROM ONE PAGE TO ONE BLOCK
WHICH TRANSLATES TO:8KB … 4MB
• SMS• CHATS• GPS DATA• EMAILS• CONTACTS• LOGS• TEXT DATA• THUMBNAILS• PICTURES• ZIP• AUDIO• VIDEO
PROBABILITY
100%
0%
![Page 13: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/13.jpg)
8KB FRAGMENT OF DATA…IS IT A LOT? HOW MUCH EXACTLY?
![Page 14: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/14.jpg)
512 BYTES OF DATA FROM OBSOLETE PAGE
WITHIN 512 BYTES OF DATA WE CAN SEE 3 SMS.
PAGE IS AT LEAST 16 TIMES LARGER.
SIMPLE CALCULATION SHOWS THAT ONE PAGEMAY CONTAIN ROUGHLY 45-50 SMS (OR CHAT MESSAGES).
NOW ASSUME THAT ONE BLOCK IS AT LEAST 128 PAGES.
128 x 45 = 5760.
SO ONE BLOCK MAY CONTAIN ~ 5000 MESSAGES.
ON PRACTISE YOU’LL GET LOTS OF DUPLICATED RECORDS DUE TO THE NATURE OF SQLITE.
SO LET’S JUST SHIRINK IT DOWN TENFOLD TO 500. IT IS STILL A HUGE AMOUNT OF DATA!!!
![Page 15: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/15.jpg)
IS THERE ANY LIFE AFTER FACTORY RESET?
YOU NEVER KNOW UNTIL YOU CHECK IT BUT AT LEAST GARBAGE BLOCKS ARE RARELY ERASED
![Page 16: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/16.jpg)
DAMAGED EMMC CHIPS
CAUSES
• WATER DAMAGE
• THERMAL DAMAGE
• PHYSICAL DAMAGE
• DAMAGE OF TRACKS/PADS ON CHIP’S PCB
• DAMAGE OF WIRE BONDING INSIDE CHIP
• HUMAN FACTOR DURING DATA RECOVERY
SYMPTOMS
• NOT RECOGNIZED WHEN CONNECTED TO EMMC ADAPTER
• RECOGNIZED BUT SHOWS WEIRD CAPACITY
• RECOGNIZED AND FIRST 32-64MB ACCESSIBLE
• RECOGNIZED BUT READS GARBAGE
![Page 17: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/17.jpg)
DAMAGED EMMC CHIPS
![Page 18: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/18.jpg)
SCENARIOS OF FAILURE
NO SHORT CIRCUIT ~80-90%
• FW CORRUPTION
• CONTROLLER DAMAGE DUE TO OVERHEAT
• WIRE BONDING DAMAGE
• UNKNOWN COTROLLER DAMAGES
SHORT CIRCUIT ~10-20%
![Page 19: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/19.jpg)
PROBLEMS WE HAD TO SOLVE TO TRANSFORM TECHNOLOGY INTO A TOOL
• UNKNOWN TECHNOLOGICAL NAND PINOUTS
• CONNECTING TO CHIPS
• NAND CONFIGURATIONS (EASY ONE)
• READ RETRY (DON’T MISS THIS PRESENTATION TODAY!)
• ADAPTIVE SCRAMBLING SCHEMES (NIGHTMARE)
• SCRAMBLED DA+SA+ECC (DON’T MISS THIS PRESENTATION TODAY!)
• PAGE BASED TRANSLATION ALGORITHMS
• DEVELOPMENT OF SPECIAL SQLITE CARVER & FILE CARVER (DON’T MISS THESE PRESENTATIONS TODAY!)
![Page 20: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/20.jpg)
DIVERSITY OF DEVICES AND TECHNOLOGICAL PINOUTS
![Page 21: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/21.jpg)
eMMC NAND RECONSTRUCTOR - HARDWARE
![Page 22: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/22.jpg)
eMMC NAND RECONSTRUCTOR - ADAPTERS
![Page 23: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/23.jpg)
eMMC NAND RECONSTRUCTOR - SOFTWARE
![Page 24: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/24.jpg)
eMMC NAND RECONSTRUCTOR - SOFTWARE
![Page 25: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/25.jpg)
AUTOMATIC CONTROLLER RECONSTRUCTION
![Page 26: eMMC-NAND RECONSTRUCTOR · 12/05/2019 · • cars • satnav systems • wearables/smartwatch • laptops • voice recorders • multimedia players ... •gps data •emails •contacts](https://reader033.fdocuments.in/reader033/viewer/2022043001/5f7ca8954b3bf746b93d42a1/html5/thumbnails/26.jpg)
NOW LET’S TAKE A SHORT COFFEE BREAK AND MOVE FORWARD TO PRACTICAL PART
WE HAVE A QUICK 15-MIN WORKSHOP AREAS WHERE YOU CAN HAVE SOME CHAT WITH OUR ENGINEERS!