SD Card File Recovery Case Study: SanDisk SDHC Memory Card

If you crack open an SD card, you’ll likely be able to see the NAND flash memory chip. NAND flash has become the go-to for solid state data storage in this day and age. You can find it in not only your SD cards, but in your flash drives, SSDs, smartphones, and tablets as well. You can think of a single NAND flash memory chip as the rough equivalent of one of your hard drive’s platters. Platters are divided up into tiny magnetically-charged regions. Each region represents a single bit of data. A NAND chip, on the other hand, is built out of cells. These cells are lined up in columns and arranged in rows across the chip. Each cell plays the same role as the magnetic regions on your hard drive’s platters.

Just like hard drive platters, NAND chips have a life expectancy. Over time and with use, the magnetic fields on parts of the platters weaken and decay, resulting in sectors going bad. The same aging process also affects NAND chips. Every time a cell is altered, it takes up a single program-erase cycle. Each cell is designed to last for hundreds of thousands of program-erase cycles or more. An SD card’s controller distributes data as evenly as it can across the chip’s cells in a process called “wear leveling”. Wear leveling can prolong a NAND chip’s life and improve its performance. But of course, life isn’t perfect, and some cells just don’t last as long as they should.

In this SD card recovery case, a lot of the NAND chip’s cells had gone bad. Solid-state devices have means of dealing with bad cells, just as hard drives have means of dealing with bad sectors. Hard drives and solid state devices like SD cards can both identify failing sectors or cells and sweep them under the rug. But sometimes a failure catches the device by surprise. In this SD card file recovery case, some of the bad cells in the SD card were enough to cripple the device. Bad cells can crop up anywhere and have a variety of effects. In many cases, the cells can be in the middle of a file. This can result in file corruption. The cells can also affect the boot sectors or partition table of a storage device, or cause firmware failure. Bad sectors and cells are always a luck of the draw scenario. If they affect the right places, you might not even notice them. If they affect the wrong places, your memory card becomes a brick.

The client, a photographer, was unable to pull their photos off of the card. While they could access the SD card and see the files on it, they could not open or copy over any of them to their computer. This client had stored thousands of pictures on their camera’s SDHC card and needed them back. Our flash memory data recovery engineers analyzed the SD card and found that there were bad cells in its flash memory chip.

SD Card File Recovery

In this SD card file recovery case, the bad cells affected the SanDisk memory card in just the right way that the data on it could still show up. But while all of the client’s photos were clearly visible, they could not be opened, saved, or copied to the client’s computer. The data was there, but the SD card had a big sign on it that said, “Look, but don’t touch.”

Here at Gillware, our SD card file recovery technicians weren’t about to let a few bad sectors get between them and the client’s data. Our technicians were able to make a write-blocked forensic image of about 99% of the storage space on the SD card’s flash memory chip. The bad cells only made up about 1% of the SD card’s total storage space. But some of that 1% had fallen in just the right place to make the client’s data inaccessible.

Our data recovery efforts proved fruitful. Of the 2,000 photos stored in the SD card’s memory, over 1,600 photos were fully and completely recovered. The remainder of the recovered photos had all been partially recovered, and many of those partially recovered photos had been nearly completely recovered, with binary reads of well over 90%. Our data recovery technicians rated this successful SanDisk SD card file recovery case a 9 on our ten-point scale.

Do you have more questions?