Finding the Block Space in Flash Extractor - Data Recovery

Main Ideas

• NAND block size can be calculated from the page size and the number of pages per block:

Block size = page size × pages per block

• The video lists common pages-per-block counts of 86, 128, 192, 256, and 512. It describes 86 and 192 as common for TLC, and 128, 256, and 512 as common for MLC.
• A datasheet example uses 16 KB pages and 512 pages per block, which gives 8 MB per block.
• In Flash Extractor, the block number shown in the spare-area interpretation can help test a proposed block size. The goal is to align the view so the block number changes at a block boundary.

Method Shown in Flash Extractor

1. Find the Page Size

Use the NAND datasheet or the NAND Reader configuration file. The example uses a page size of 16 KB.

2. Choose a Likely Pages-per-Block Value

The presenter assumes MLC memory and starts with 128 pages per block. In the demonstration, the Flash Extractor jump amount is adjusted to represent a candidate block size. Ctrl+Up and Ctrl+Down can double or halve that value.

3. Identify the Relevant Flash Extractor Display

The interface includes a jump-by-address field, a search bar, an address box, a hex editor, and a parsed spare-area display. The spare-area display shows the block number and indicates ECC status and whether the block is an update block.

4. Use the Keyboard Controls

• Ctrl+Home: Aligns the address to the start of the interval represented by the jump value by removing the remainder.
• Ctrl+Page Down: Moves down by the jump amount.
• Ctrl+Page Up: Moves up by the jump amount.
• Ctrl+Down Arrow: Halves the jump value.
• Ctrl+Up Arrow: Doubles the jump value.

5. Test and Refine the Candidate Block Size

Move through the dump with Ctrl+Page Down and check whether the displayed block number changes. If it does not, adjust the jump value—doubling it in the demonstration—and test again.

Recenter with Ctrl+Home, then inspect nearby positions. To confirm a boundary, the block number should change when moving across it: positions on one side should show one block number, and positions on the other side should show the next.

The presenter concludes that the block size in the demonstrated dump is 16 MB.

Note: The subtitles contain a possible inconsistency. The datasheet arithmetic gives 8 MB for 16 KB pages × 512 pages, while the hands-on procedure concludes 16 MB. The video does not resolve the discrepancy.

Speakers and Sources Featured

• Narrator/presenter: Explains the NAND block-size calculation and demonstrates the procedure.
• Flash Extractor: Software used to inspect the dump and test block boundaries.
• NAND datasheet: Cited for the example page size and pages-per-block figures.
• NAND Reader configuration file: Mentioned as another source for the page size.