Forensics
Physically damaged SD card - summary and update Jan 17 2007 12:38AM
Michael Edwards (medwards digital-legal com)
Thanks much for the suggestions, which have included:

Recovery programs, such as Zero Assumption Recovery;
Suggesting imaging the card and working with the image;
Powered vs. passive USB, low speed mode;
Try it in the original device (camera);
Place SD card in the freezer;
Heating the foil runs to attempt to repair breaks;
Physically attempting to solder or complete broken traces (using a
staple, a very fine tipped soldering iron);
Removing the PCBA and placing in a different SD case;

And the following links:
Recovery tips
http://gentoo-wiki.com/Photo_Recovery_From_Defective_Memory_Card

Recovery Service
http://www.kurt.hu/datarecovery/recoveryprices

How to disassemble a SD card
http://www.palm.com/us/support/contact/environment/disassem_inst_sd_card

How to remove a chip by melting solder in a electric skillet
http://www.sparkfun.com/commerce/present.php?p=Reflow%20Skillet

Zero Assumption Recovery (free for working on digital photos)
http://www.z-a-recovery.com/digital-image-recovery.htm

Here's what I tried:

Various attempts to mount and read the SD card - as described
previously, about 1 in 20 or so attempts would result in it reading,
but it would error out and freeze shortly after any attempted access.
Imaging the card was out because of this - I tried several programs,
such as Access Data's FTK Imager. It would read a short time, and
then the imaging program would report bad sectors for the rest (vast
majority) of the image. Some photos in the read portion were able to
be recovered, however.

Cleaning the contacts (with an eraser). No discernable effect, but
the card was brand new, so I didn't expect one.

Freezing the card - placed in a ziplock bag to avoid moisture
condensation, and left in freezer a few hours, then overnight. No
notable effect.

Trying different readers, and the original camera. No discernable
differences, but my SanDisk Imagemate 12-in-one did prove to be
handy, largely by virtue of the fact that the SD card protrudes about
half-way out of this reader (many others require the complete
insertion of the card). This helped greatly later, when the card was
partially disassembled. I also tried different computers, to ensure
different USB busses or controllers might not be affecting things.

Opening the card up to check on the internal board/chips - following
the linked Palm guide, I was able to open the card. The card had
cracks appearing in the case in two places, on the non-label side of
the card (and possibly under the label). I was able to pry/peel off
this side of the case, and remove and examine the card. I was unable
to determine that the PCBA (printed circuit board assembly) had any
damage or loose connections, but I didn't have a really good loupe or
microscope to help in this inspection. I was able to place the PCBA
back into the bottom half of the case, and continue to re-insert the
card into the SanDisk reader, while trying some unprofessional
flexing tests to see if there was a loose connection. This had no
discernable effect.

Recovery programs, such as Zero Assumption Recovery (and a few
others), generally suffered from the same issue as imaging. They
would not read the card if it failed to initially mount. Waiting
until the drive mounted, and then running the program, would start
recovery, but then then drive would "freeze" and the program would
assume the rest of the drive could not be read. ZAR did have more
options to deal with this than other programs I tried (including
resetting the drive bus on bad block reads), but did not have more success.

Eventually, patience and stubbornness won out. Repeated daily
mounting attempts would yeld some reads. When this happened, I would
attempt to copy a folder of photos that I had not yet recovered -
having backed up about half the contents of the card to an iPod
midway through my trip. This would result in 0 or more photos copying
successfully, before the card locked up. I would then attempt to pick
up where I left off on my next successful mounting of the drive.

I also found that attempting to mount (in Windows XP SP2) after
rebooting the machine, appeared to have more success than just
repeatedly removing and re-inserting the card. This may merely be
perception, or might be my impatiently not waiting long enough
between attempts otherwise.

I did eventually get a pretty good session, that didn't freeze up.
This allowed me to completely recover the missing photos, and the
movies that I had taken. A few of the movies have corrupted frames in
short portions of them, but otherwise, everything appears good.

Unfortunately, I have been unable to determine what the exact source
of the difficulty was, and why I was able to get a good read of the
card, but I hope this information might be helpful in some way.

--
Michael Edwards

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus