Physical Data Recovery from a CompactFlash Card
TECHNICAL DETAILS
The CompactFlash interface is a 50-pin subset of the 68-pin PCMCIA[14] connector. The card can be inserted into a passive 68-pin PCMCIA Type II to CF Type I adapter that fully meets PCMCIA electrical and mechanical interface specifications. The interface operates, depending on the state of a mode pin on power-up, as either a 16-bit PC Card (0x7FF address limit) or as an IDE (PATA) interface.
The CF device contains an ATA controller and appears to the host device as if it were a hard disk. CF cards with flash memory are able to cope with extremely rapid changes in temperature from −45°C to +85°C. There may be slight variations depending on the manufacturer of the CF, but for the most part there is a great range in temperature fluctuation which is perfect for the photography industy.
LIMITATIONS
- – Battery life
- – Number of erase/write cycles: NOR flash has a write endurance of 10,000 cycles and NAND flash 1,000,000 writes per block before hard failure
- – Wear on blocks
- – CF’s use a wear leveling process that varies the physical location to which a block is written
- – NAND flash memory is prone to frequent soft read errors
- – It does have error checking and correcting that detects the error and re-reads the block
- – Lacks the mechanical write protection switch that other devices have
- – Limited use due to its size
ITEMS THAT CAN PREVENT DATA RECOVERY
- – Accidental reformatting causing corruption
- – Over shooting the card can corrupt images and may lead to card lockup
- – Using the card in more than one camera without formatting each time can corrupt the card
- – Deleting images in the camera can result in a back fill problem that computers are able to piece together, but can make data recovery difficult.
- – ex: Picture 2 (new picture) 1.25MB deleted and new picture 2 (back filled) is 1.60MB in size
- – Logical/software issue with being seen on the computer
- – Removing the card from the camera when still recording images
- – Not all cameras allow the card removal while still powered on
- – Dirt and lint can ruin the cards if they’re not stored in their case
- – Camera battery dies as images are recording can cause a card error
The basic concept behind flash file systems is the following: when the flash store is to be updated, the file system will write a new copy of the changed data to a fresh block, remap the file pointers, then erase the old block later when it has time. So as long as the file structure is not corrupt the images can be restored.
However, severe corruption can affect the raw files making them recoverable, but unreadable. There is still hope, but it is not an inexpensive option and that is to read off of the flash memory its self. This requires a clean lab and a few other high end tools.
Until next time from Data Buzz.
