Datarecovery of mobile devices, in casu the Trimble Ranger TSC3CN
We began with the reading of the flash memory of the Trimble. For this, the memory chips were physically removed, and read by an external reader. Then they were soldered back so that the unit was functional again. After analyzing the flash memory it seems to use the filesystem yaffs2 (yet another flash file system). A relatively uncommon file system with virtually no support.
Moreover, it appears that Microsoft does not follow the yaffs2 standard and has added his own modifications. In consultation with a colleague this version of yaffs2 was decomposed through reverse engineering and a program was written to extract the files from the flash dumps.
Ultimately, we could retrieve the data needed by my client. I wonder if we will see more of these cases. Nice to know is that Yaffs2 is also used in some android devices.