Identification of NAND flash ECC algorithms in mobile devices

In the field of mobile device forensics and in flash memory data recovery, physical chip extraction is an important method for acquiring data from flash memory. However, this method can result in random errors in the full copy of the flash memory data, which reduces the accuracy of extracted electronic evidence and of the recovered data. Therefore, it is necessary to determine which Error Checking and Correction (ECC) algorithm was used in the flash controller, and then to implement this same ECC algorithm in software to detect and correct random errors. This paper presents some methods for identifying the NAND flash ECC algorithm in mobile devices. The method starts with a determination the location of the ECC code bytes in the spare area of a chip, then proceeds with an analysis of the parameters of the possible ECC algorithm, and finally verifies the ECC algorithm in software. Our experimental results show that the proposed method is effective in identifying a Hamming algorithm that may serve as a substitute for the ECC hardware built into the flash controller to detect and correct errors in the data.