際際滷

際際滷Share a Scribd company logo
Flash Drive
 What is Flash drive?
 Connect(DRIVER)
How it works?
Why show less capacity?
File system
   A.   NTFS (New Technology File System)
   B.   FAT 32 (File Allocation Table)
Recovery procedure
   A.   Flasher tools
   B.   JTAG (joint Test Action Group)
   C.   Physical Extraction
 Future Recovery Procedure.
FLASH DRIVE

larger drives available 16 MB as large as 256GB.
 Use a microprocessor that uses the EEPROM
style of storage.
This memory uses a USB transfer protocol(2.0)
that facilitates rapid data transfers.
It can be connected to any USB port on a
computer for the purpose of transferring, moving
and/or saving files.
Flash Drive Connects to
                     Computer
 HOT Plug and play device.

 The flash drive downloads small amounts of data, known as
drivers, to the computer.

Ensure that you do not disconnect the drive directly from the
machine.

Once the Flash drive has been plugged into the laptop, it will be
accessible within a few minutes if this is the first time it is being used
with that specific computer. If the flash drive has been used before,
it will be available immediately.
How it Works
It "solid state" technology to store data. solid state
storage units write data electronically to the media.

the data is electrically stored in these blocks and
remains even if the USB drive does not have power.

It's easiest to think of flash memory like a chalk
board. The data you place on it will
remain, indefinitely, until you erase it. Like erasing and
changing a single word on a chalk board, deleting or
altering one file will not affect the rest of the drive
Why does my USB drive show less capacity

Storage devices use a
decimal system
PCs use the binary
system
The difference can be
between about 2% -
9% depending on the
capacity of the drive.
File system

You can choose between two file systems :
                NTFS and FAT32
FAT32 is a simple system that is documented and mainly keeps
track of file locations. The simplicity of FAT32 has made it the file
system of choice for portable storage mediums.
The number "32" in FAT32 denotes the number of bits needed to
keep track of the files.
NTFS is much more flexible than FAT32. NTFS has great security
and file encryption. If there is more than one operating system on
a single computer, it is better to format some volumes as FAT32
Data Recovery from flash drive
It is a type of nonvolatile memory.
Logical Structure of these chips are NAND FLASH.
Basic of flash technology first on the physical level
and then logical level.
Three approach are presented for obtaining a full
copy of flash memory.

                                (to be continued)
Under Physical level
 It store data in flash memory is based on storing
  electrical charge into a floating gate of a transistor.
 These charge are stored for extend period of time.
 Need no power supply.
 But leak by physical damage.
Uses WEAR LEVELLLING
ALGORITHM (THE EXACT
BINARY COPY OF THE
PHYSICAL F.M.



It contain multiplexed
address/data bus.
Generally for I/0 lines.
Either be 8/16 bits wide.
The spare area can
contain information
on the status of the block
or the page.
Logical Level

1.Flasher tools
    The most easy way to read flash data is by
    using a simple hardware interface and s/w
    that copies all F.M. data from target system.

2.JTAG
     It is a JTAG test port is normally used to test
or debug embedded system but can also be used
to access F.M. data.
3.Physical Extraction
  Another way to produce an image of F.M. is o
  physical remove a F.M. chip and then read this
  with a reader.

 THIS method is used when JTAG and s/w tools
  not in used.
Conclusion
 More research is needed for F.D. that can be
  translated to file system level.
 Wear leveling on one side and the resulting
  data recovery analysis on other side.

More Related Content

F.d.

  • 1. Flash Drive What is Flash drive? Connect(DRIVER) How it works? Why show less capacity? File system A. NTFS (New Technology File System) B. FAT 32 (File Allocation Table) Recovery procedure A. Flasher tools B. JTAG (joint Test Action Group) C. Physical Extraction Future Recovery Procedure.
  • 2. FLASH DRIVE larger drives available 16 MB as large as 256GB. Use a microprocessor that uses the EEPROM style of storage. This memory uses a USB transfer protocol(2.0) that facilitates rapid data transfers. It can be connected to any USB port on a computer for the purpose of transferring, moving and/or saving files.
  • 3. Flash Drive Connects to Computer HOT Plug and play device. The flash drive downloads small amounts of data, known as drivers, to the computer. Ensure that you do not disconnect the drive directly from the machine. Once the Flash drive has been plugged into the laptop, it will be accessible within a few minutes if this is the first time it is being used with that specific computer. If the flash drive has been used before, it will be available immediately.
  • 4. How it Works It "solid state" technology to store data. solid state storage units write data electronically to the media. the data is electrically stored in these blocks and remains even if the USB drive does not have power. It's easiest to think of flash memory like a chalk board. The data you place on it will remain, indefinitely, until you erase it. Like erasing and changing a single word on a chalk board, deleting or altering one file will not affect the rest of the drive
  • 5. Why does my USB drive show less capacity Storage devices use a decimal system PCs use the binary system The difference can be between about 2% - 9% depending on the capacity of the drive.
  • 6. File system You can choose between two file systems : NTFS and FAT32 FAT32 is a simple system that is documented and mainly keeps track of file locations. The simplicity of FAT32 has made it the file system of choice for portable storage mediums. The number "32" in FAT32 denotes the number of bits needed to keep track of the files. NTFS is much more flexible than FAT32. NTFS has great security and file encryption. If there is more than one operating system on a single computer, it is better to format some volumes as FAT32
  • 7. Data Recovery from flash drive It is a type of nonvolatile memory. Logical Structure of these chips are NAND FLASH. Basic of flash technology first on the physical level and then logical level. Three approach are presented for obtaining a full copy of flash memory. (to be continued)
  • 8. Under Physical level It store data in flash memory is based on storing electrical charge into a floating gate of a transistor. These charge are stored for extend period of time. Need no power supply. But leak by physical damage.
  • 9. Uses WEAR LEVELLLING ALGORITHM (THE EXACT BINARY COPY OF THE PHYSICAL F.M. It contain multiplexed address/data bus. Generally for I/0 lines. Either be 8/16 bits wide. The spare area can contain information on the status of the block or the page.
  • 10. Logical Level 1.Flasher tools The most easy way to read flash data is by using a simple hardware interface and s/w that copies all F.M. data from target system. 2.JTAG It is a JTAG test port is normally used to test or debug embedded system but can also be used to access F.M. data.
  • 11. 3.Physical Extraction Another way to produce an image of F.M. is o physical remove a F.M. chip and then read this with a reader. THIS method is used when JTAG and s/w tools not in used.
  • 12. Conclusion More research is needed for F.D. that can be translated to file system level. Wear leveling on one side and the resulting data recovery analysis on other side.