The one thing flash drive recovery had going for it was easy direct access to the underlying storage medium. Inside the casing of that USB thumb drive or camera card is an industry-standard NAND flash memory chip. Whereas hard disk platters can realistically only be read by the drive that recorded to them, that memory chip can be removed from the circuit board and read by any number of device programmers available online. The real challenge is turning that raw memory dump into something useful. What you get directly from the memory chip looks nothing like what your PC sees when the drive is plugged in a USB port. Instead, it looks more like a jigsaw puzzle spread out on your coffee table. Intermixed with user data are bits of information the drive uses for its own internal operation. To get at individual files, this information must be stripped, error correction codes applied, and finally all the pieces reassembled in the correct order.

The internals of a traditional USB thumb drive. The large chip on the right is standard NAND flash memory, which can be removed and read with a device programmer.
The internals of a traditional USB thumb drive. The large chip on the right is standard NAND flash memory, which can be removed and read with a device programmer.

Imagine our dismay the first time we opened the case of a failed USB thumb drive to find something like this staring back at us.

A monolithic USB thumb drive
A monolithic USB thumb drive

What the heck is this?!?! Well, that, sports fans, is the latest craze- a monolithic USB thumb drive or “monolith” for short. Instead of many discrete components installed together on a circuit board, many flash drives today contain what appears to be a single chip with four gold fingers to plug into a USB port. The monolith has many things going for it- smaller size, water-proof, and cheaper to manufacture (I imagine, as this seems to be the sole driving force behind every innovation in the storage industry these days). But what protects the drive from the elements also protects the drive from recovery engineers. How do you get at the NAND flash memory when it’s buried in an enclosure like this? Is there even a separate memory element to be gotten at or is this some sort of radical new design?

Naturally, we had to get to the bottom of this. Check out the video below to learn more about how Gillware recovered data from a failed monolithic USB flash drive.