DFIR

Ask me a question

Ask me a question

Hello Jean-Michelle, I  have a question about the artivel 'From NAND chip to files'. I copied the content of a NAND chip to a bin file with TNM5000, the bin file is approx. 4,5 GB. Do you have any idea about how to read the files from the bin file? I tried to mount it in Linux but it seems the maximum size is 256MB. Thank you for your help! Best regards, Laszlo

Ask me a question

Ask me a question

Hi Jean-Michel, I'd like to dump the firmware of my Samsung SM951 M.2 NVMe drive. Do you know how to do that?. If so, could you create a tool to dump firmwares of SSDs (SATA/M.2). I'm telling you this, because there are many people like me that are looking for a tool or utility to do that, but it haven't appeared yet. Thank you!!.

From NAND chip to files

From NAND chip to files

First of all, I am pretty happy to write this article because I usually don’t have a lot of opportunities to write about forensics topics on this blog. The main reason for that situation is because I am almost always working on that field for my employer so this does not have a place on this blog . But this time it was related to a spare time project I did during my holidays!

You’re not going to have a lot of details about the whole project because it is still ongoing and moreover I am working on it with a friend and we hope to do a bigger publication once we are done. Anyway, I went through a lot a caveats so I thought it was worth writing about that step in our study.

Hard drive rescuing with a GoodFET

Hard drive rescuing with a GoodFET

This post is a little pause in my vacuum reversing trilogy. It is half about electronics, half about digital forensics but somehow it is still 100% of my hobbies ;-)

A friend of mine had faced a harddrive failure recently and wanted her data back. So she sent me the drive instead of giving away one month of salary to an expensive data rescuing company.

Most of the time, replacing the controller board of the harddrive is enough to get your data back. Hopefully some companies like HDDzone allows you to order the exact model of the PCB you want to replace.

One week later, the PCB was in my mail box. Great.