Flash drives use solid state memory to store data electronically without needing a power source. They connect to computers using USB ports to allow for rapid transfer of files and data. However, their listed storage capacity is typically less than what is shown due to differences between decimal and binary measurements. There are various file systems and recovery procedures that can be used to access and retrieve data from flash drives.

1. Flash Drive
 What is Flash drive?
 Connect(DRIVER)
How it works?
Why show less capacity?
File system
A. NTFS (New Technology File System)
B. FAT 32 (File Allocation Table)
Recovery procedure
A. Flasher tools
B. JTAG (joint Test Action Group)
C. Physical Extraction
 Future Recovery Procedure.

2. FLASH DRIVE
larger drives available 16 MB as large as 256GB.
 Use a microprocessor that uses the EEPROM
style of storage.
This memory uses a USB transfer protocol(2.0)
that facilitates rapid data transfers.
It can be connected to any USB port on a
computer for the purpose of transferring, moving
and/or saving files.

3. Flash Drive Connects to
Computer
 HOT Plug and play device.
 The flash drive downloads small amounts of data, known as
drivers, to the computer.
Ensure that you do not disconnect the drive directly from the
machine.
Once the Flash drive has been plugged into the laptop, it will be
accessible within a few minutes if this is the first time it is being used
with that specific computer. If the flash drive has been used before,
it will be available immediately.

4. How it Works
It "solid state" technology to store data. solid state
storage units write data electronically to the media.
the data is electrically stored in these blocks and
remains even if the USB drive does not have power.
It's easiest to think of flash memory like a chalk
board. The data you place on it will
remain, indefinitely, until you erase it. Like erasing and
changing a single word on a chalk board, deleting or
altering one file will not affect the rest of the drive

5. Why does my USB drive show less capacity
•Storage devices use a
decimal system
•PCs use the binary
system
•The difference can be
between about 2% -
9% depending on the
capacity of the drive.

6. File system
You can choose between two file systems :
NTFS and FAT32
FAT32 is a simple system that is documented and mainly keeps
track of file locations. The simplicity of FAT32 has made it the file
system of choice for portable storage mediums.
The number "32" in FAT32 denotes the number of bits needed to
keep track of the files.
NTFS is much more flexible than FAT32. NTFS has great security
and file encryption. If there is more than one operating system on
a single computer, it is better to format some volumes as FAT32

7. Data Recovery from flash drive
•It is a type of non–volatile memory.
•Logical Structure of these chips are NAND FLASH.
•Basic of flash technology first on the physical level
and then logical level.
•Three approach are presented for obtaining a full
copy of flash memory.
(to be continued…)

8. Under Physical level
• It store data in flash memory is based on storing
electrical charge into a floating gate of a transistor.
• These charge are stored for extend period of time.
• Need no power supply.
• But leak by physical damage.

9. •Uses WEAR LEVELLLING
ALGORITHM (THE EXACT
BINARY COPY OF THE
PHYSICAL F.M.
•It contain multiplexed
address/data bus.
Generally for I/0 lines.
Either be 8/16 bits wide.
•The spare area can
contain information
on the status of the block
or the page.

10. Logical Level
1.Flasher tools
The most easy way to read flash data is by
using a simple hardware interface and s/w
that copies all F.M. data from target system.
2.JTAG
It is a JTAG test port is normally used to test
or debug embedded system but can also be used
to access F.M. data.

11. 3.Physical Extraction
Another way to produce an image of F.M. is o
physical remove a F.M. chip and then read this
with a reader.
• THIS method is used when JTAG and s/w tools
not in used.

12. Conclusion
• More research is needed for F.D. that can be
translated to file system level.
• Wear leveling on one side and the resulting
data recovery analysis on other side.