Why is it so complex and why few data recovery companies can actually do it?
All the chips and the PCB in such devices are molded into a polymer (plastic) or coating. It is, in theory, not possible to access the components (controller chip and Nand Chips (memory)).
First step: PCB Access and Mapping
The first thing is to access the PCB of a similar micro SD card or usb monolith. See below an example of a micro SD card form Sandisk where the coating has been removed (Never do that on the original media).
Second step: Understand which pins of the chips goes where: Pins Out
The second phase if to get which pins of the chips (controller and Nand) goes where and is doing what. So you can afterwards connect the original micro SD or monolith usb to a flash adaptator and extract the data (Dump).
Third step: Extract data and wiring
This pictures shows the original micro SD we want to recover data from. Only a tiny part of the coating is removed and the right points of the PCB are connected the proper flash extractor bench.
Note: If we have already the pin outs and mapping of the PCB we directly jump to the third step and save a lot of time and cost of actually understanding the mapping and pin outs.
Then we proceed a dump of the flash memory.
Last step: Rebuilt Data
There are a few more challenges still…
– At this stage it might be impossible to extract data
The chips might be damaged or unreadable.
– We have to deal with encryption
– A huge care is paid the ‘wear leveling‘ algorithm