Datarecovery of mobile devices, in casu the Trimble Ranger TSC3CN
2016-05-30 00:00:00
30
MAY
We got a call from a land surveyor, asking if we could recover data from his faulty Trimble Ranger. These devices operate with flash memory and Windows Mobile. No data recovery company was found to support this. For us it was again a nice challenge. A big problem was that the unit was to be kept in a working condition, because the problem could be solved with a software upgrade (which, however, erases all data). We had to proceed delicately.
We began with the reading of the flash memory of the Trimble. For this, the memory chips were physically removed, and read by an external reader. Then they were soldered back so that the unit was functional again. After analyzing the flash memory it seems to use the filesystem yaffs2 (yet another flash file system). A relatively uncommon file system with virtually no support.
Moreover, it appears that Microsoft does not follow the yaffs2 standard and has added his own modifications. In consultation with a colleague this version of yaffs2 was decomposed through reverse engineering and a program was written to extract the files from the flash dumps.
We began with the reading of the flash memory of the Trimble. For this, the memory chips were physically removed, and read by an external reader. Then they were soldered back so that the unit was functional again. After analyzing the flash memory it seems to use the filesystem yaffs2 (yet another flash file system). A relatively uncommon file system with virtually no support.
Moreover, it appears that Microsoft does not follow the yaffs2 standard and has added his own modifications. In consultation with a colleague this version of yaffs2 was decomposed through reverse engineering and a program was written to extract the files from the flash dumps.
Ultimately, we could retrieve the data needed by my client. I wonder if we will see more of these cases. Nice to know is that Yaffs2 is also used in some android devices.