Riffbox plugins for nand devices

[hakko]

Hi! I had one slc nand dump from an android device and I want to know if riffbox support this kind of file for analysis.

Thanks in advance!

[Legija]

If this is nand image recovered from failed emmc or sd card then not, because such image has to be reassembled first and we didn't made support for such cases (yet). There is few other tools which can do that, one is Rusolut.

[hakko]

hi! The image comes from a working device... What is the difference form nand and emmc? Only the reserved page area?

[Legija]

If this is readout from older android phone with nand flash, You can use qualcomm plugin to parse it. Of course must be in raw binary format with spare data at the end of file, or without spare data at all.
Please provide info on following:
1. Model
2. How did you read it out (what tools/software)

Note that Qualcomm plugin can parse and show partitions, but there is no content extractor like in emmc plugin.

[hakko]

It's not a phone. it's special module, with broadcom cortex A9 cpu with nand flash... I need to acess root shell by serial port on this device or mount the file system. I had used beeprog+ to read full content. But maybe i need to read the flash multiple time and fix bit errors by comparing them. The flash size is quite small only 4Gib. I used binwalk to check the image but i think i need to remove spare area first

[Legija]

If its broadcom it most probably wont be recognized.
Step one would be to determine how spare is stored and then to remove it. Next, determine file system and logical partitions. Disk genius comes into mind as the one able to handle most of file systems.

[hakko]

Just an update on this. Disk genius does not suport the embedded file systems. But i was able to extract some data from some partitions and managed to get the disk partition layout. I can even mount some of the partitoins or get it's data. But the most important one are based on Ubifs and this one i can't read any data i can surf on the folders nothing more. This kind of file system uses zlo based compression and looking at dmesg it fails to extract data.

I think it's because of nand bit errors that needs to be fixed. Now i'am trying to identify how the oob area layout works. I have some info of the nand controller but not so much.

Do you have expertise on this knid of problem?

Thanks!

[Legija]

Not really.
Some of the forensic tools should work, given that nand image is cleaned first from spare chunks. One idea maybe is to mount such image under android, but it could be tricky due to page size (just thinking).