Samsung Read Retry Solved

Samsung came out with one of the first generations of Read Retry chips a few years back. Models: K9BCG08U1M, K9BCG08U1A, K9CDG08U5A, K9ABG08U0A based off the same die w/ an ID of ec d7 98 ca (0xecd798ca). Read Retry is a mode which changes the threshold for what constitutes as a value for the number of electrons stored in a cell. To increase density (capacity) there are fewer electrons per cell in modern NAND chips than previous generations. The amount of errors generated by leaking electrons is greater than most controllers can correct, by changing the threshold you can get a more reliable data.

Samsung (like most manufactures) doesn’t disclose the Read Retry commands in their datasheets which meant if we tried to read those Samsung NAND chips normally we’d get a high raw error rate, basically the data was unusable for recovery. So what did we do? Break out the trusty logic analyzer and snoop on a working drive.

It seems like this chip is only used with Silicon Motion controllers. After reading an uncorrectable sector we’d see the controller reset the die, issue an 60h command and modify a set of registers. All told it appears there a total of 16 unique retry modes.

When one mode fails to return useable data the controller loops through all modes until it times out and reboots the controller. When these drives fail the end user has a similar experience, the drive “works” but when trying to access specific files/folders/etc it locks up and reconnects. Unlike read retry on most drives it’s difficult to get a 100% good read from the NAND chip (which is also evident by the controller read failing and rebooting), good reads are around 99.3%. That sounds fantastic but there will most likely be corruption within some recovered files. Still recovering almost all the files is better than none.