SanDisk SDCZ430-512GB – Data Recovery Attempt

Every once and a while we see an interesting case. This time it was a SanDisk SDCZ430-512GB that was detected as 2308 PRAM / 2308 Boot ROM. At first I thought it was a new SanDisk controller however it was strange in that it responded to Phison diagnostic commands, also when Phison controllers are failing the model number might revert to a similar PRAM name.

We were able to stabalize the memory chip through the USB interface enough that we could see there was no data on the drive, only a chkdisk log suggesting all the data had been wiped. Maybe the data was still in the memory chip, the customer gave the okay to tear the monolithic memory chip apart and read the physical NAND chip

During pinout discovery we found the drive had a 2×4 configuration meaning two data buses and four chips per bus, so a total of 8 physical memory chips, 64GB each, bringing the capacity up to 512GB. We also discovered that it was using a Phison PS2251 controller with a 1151_1_1143_1 geometry and SanDisk v3 Read Retry protocol (ID: 45 3E 98 03 76 6C).

We read the NAND memory chips over the next two days and corrected all the ECC errors, afterwards we solved the mix and reassembled the final image from the raw memory dump, sadly to find all the data had been erased in the memory chip.

No love, 5 days of work down the drain with no pay… The downside of a no data, no charge policy. On the upside we now have a data recovery solution for this drive along with its encryption key in-case we see it again.

In this specific instance SanDisk decided to use another companies product in their case. I’ve seen this before with SanDisk using a Silicon Motion / Hynix configuration.

On to the next one.  If you need your SanDisk flash drive recovered consider sending it in for SanDisk Ultra Flair Data Recovery