Case Study 1 — Kingston USB Flash Drive (Burnt Electronics, Not Recognised)

Symptoms

Device not enumerating on any host. Strong electrical odour noted; visual inspection shows localised heat discolouration near the USB power-entry stage. Incident likely caused by a power surge or incorrect PSU/USB hub behaviour.

Forensic Intake & Findings

• VBUS short: Bench PSU at 5.00 V with a 200 mA current limit immediately hit CC—indicative of a low-ohm short to ground on the 5 V rail.

• Thermal hotspot: IR camera identified the transient voltage suppressor (TVS) and a downstream DC-DC/PMIC as the principal heat sources.

• Controller state: No D+ / D– activity; 60 Ω differential line check nominal → suggests the USB PHY isn’t even initialising due to a primary rail fault.

• Construction: Two variants are common for this family: (1) traditional PCB with discrete controller (Phison/SMI/Alcor/Innostor) + TSOP-48/BGA-132/152 NAND; or (2) monolithic (COB) package with all silicon wire-bonded under epoxy.

Recovery Approach (Technical)

1) Do-no-harm power isolation
We never brute-force power: the stick is powered only via a current-limited lab supply for diagnostics; no host port is used. This prevents further controller or NAND degradation.

2) If PCB + discrete NAND (preferred path)

• Electronics triage: Remove shorted TVS; verify downstream 3.3 V/1.8 V rails; if PMIC or controller remains shorted, we bypass logic entirely.

• Chip-off:

  • Desolder NAND (TSOP-48 or BGA-132/152) using controlled thermal profiles; inspect pads for lifted balls or delamination.

  • NAND acquisition: Read raw on PC-3000 Flash / Rusolut VNR with per-die, per-LUN passes; capture spare/OOB for ECC.

  • Signal processing: Apply the correct ECC (BCH/LDPC), interleave, die/plane pairing, page size (e.g., 16 KiB + 1.5 KiB OOB), scrambling/XOR and translation (FTL).

  • Block pairing & mix: Many USB controllers stripe across multiple channels; we reconstruct channel order using entropy correlation and factory bad-block tables (BBT) found in system areas.

  • Logical rebuild: Once the virtual address space is reconstructed, we mount the resulting image read-only and recover the original filesystem (commonly FAT32/exFAT/NTFS) and data.

3) If monolithic COB (no discrete packages)

• Pinout discovery: Use database-assisted pin mapping; where undocumented, we expose pads by controlled milling and probe using oscilloscope + continuity against known monolith families; if needed, bond to Spider Board adapters.

• Direct NAND read: Acquire raw dumps via monolith adapters; proceed with the same ECC/XOR/translator pipeline as above.

• Controller-level AES caveat: Some sticks implement controller-side AES. If present, keys typically reside inside the controller; chip-off will yield encrypted data. In those rare cases, decryption is only possible if keys/firmware blobs are externally retrievable (usually not). We test for this early by pattern analysis of dumps.

Outcome
In this case, the TVS and PMIC were destroyed; we executed a chip-off workflow from dual-die BGA NAND, applied controller-specific XOR and LDPC parameters, rebuilt the FTL, and delivered a fully browsable file set with per-file SHA-256 verification.

Case Study 2 — SanDisk 128 GB Extreme PRO SDXC (Partial Overwrite After Wedding Shoot)

Symptoms

Card remains readable but a portion of the original wedding footage/photos is missing or fails to open. The photographer continued recording before realising no backup had been made. Media was then removed and presented to us.

Forensic Intake & Findings

• Card profile: UHS-I SDXC, exFAT volume. Wear-levelling and garbage collection handled by the controller; TRIM is not relevant for SD cards in cameras.

• State: No controller faults; consistent read speeds; no need for chip-off (which cannot resurrect sectors already physically overwritten).

• Filesystem: Directory entries and allocation bitmap show regions re-allocated after the event. Some original cluster chains remain intact; others have been partially overwritten by later clips.

Recovery Approach (Technical)

1) Immutable imaging

• Acquire a full, bit-accurate image with forensic write-blocking. We capture multiple passes to stabilise marginal regions and to snapshot the card’s post-incident state.

2) Metadata-first reconstruction

• exFAT structures: Parse the Volume Boot Record, UpCase table, allocation bitmap, and directory sets. We reconstruct deleted directory entries and re-link chains where the allocation map is still valid.

• Camera-aware carving:

  • For JPEG/HEIF/RAW (CR2/CR3/NEF/ARW/RAF/DNG) and MP4/MOV: we use header/footer signatures plus deep structural validation—JPEG Huffman tables, EXIF/TIFF IFD trees, MP4 ‘ftyp/moov/mvhd’ atoms, time-scale checks, and inter-chunk continuity.

  • Fragment reassembly heuristics: For fragmented media we match GOP patterns, timecode continuity, sensor bit-depth, and entropy profiles to stitch adjacent clusters; this exceeds naive carving.

• What overwritten means: If later footage has re-programmed NAND pages that previously held part of an earlier file, those earlier bytes are irrecoverable at the physical level. Chip-off cannot recover programmed-over cells due to how NAND erase/program cycles work.

3) Deliverables & validation

• We produce two sets: (a) metadata-recovered files (original names/paths where possible) and (b) carved assets with confidence scores. Video is QC’d for playable duration, A/V sync, and moov atom integrity. All outputs are hashed (SHA-256).

Outcome
Large portions of the shoot were recovered intact from unallocated clusters; partially overwritten files were delivered as playable segments with documented truncation points. The client received a timeline map showing recovered vs. lost intervals.

Case Study 3 — MacBook Air 13-inch (M3, 2024) Boots Only to macOS Recovery/Utilities

Important architecture note: The 2024 M3 MacBook Air uses on-board NVMe NAND tied to the Apple Silicon SoC and its Secure Enclave (SEP). There is no Fusion Drive in MacBook Air models. Data at rest is hardware-encrypted; successful recovery requires valid credentials (user password/FileVault recovery key/iCloud-based recovery, as applicable). Chip-off de-soldering of NAND will not yield decryptable data outside the original logic board + SEP.

Symptoms

System loops to Recovery. Apple retail could not complete a revive/restore without data loss. Client requires data preservation.

Forensic Intake & Findings

• Device enters 1 True Recovery (1TR); Data volume not mounting, or APFS container shows checkpoint/OMAP anomalies.

• Hardware passes power-on self tests, but storage paths may present intermittent NVMe errors, SEP keybag unlock failures, or APFS snapshot corruption.

Recovery Approach (Technical)

1) Preserve state & credentials

• Document and verify availability of user password / FileVault recovery key (mandatory for decryption).

• Record NVRAM/diagnostic logs where accessible. No destructive operations are performed.

2) Non-destructive firmware remediation

• DFU Revive via Apple Configurator (on a host Mac) to refresh iBoot/bridgeOS components without erasing the internal storage. Successful revives often re-enable sufficient boot services to unlock the Data volume.

• If 1TR is reachable: use Share Disk (the Apple-Silicon replacement for Target Disk Mode) to expose the internal APFS container to a trusted host for imaging.

3) Full-disk imaging & APFS repair on images (never on the live device)

• Block-level imaging of the physical NVMe namespace using Apple-aware tooling (admin-command reads; throttled to avoid thermal throttling).

• Decryption: Mount the APFS container from the image using client-supplied credentials; unlock the Data volume and snapshot set.

• APFS reconstruction:

  • Rebuild OMAP/object store; validate NX superblocks and checkpoint chains; select the most coherent snapshot by transaction ID.

  • Extract user data from the mounted snapshot(s) read-only.

• If the board is unstable: Board-level micro-repair (short-to-ground hunts on key rails, regulator replacement, PMU rework) may be performed only to bring the original logic board to a minimally stable state for imaging. Keys cannot be migrated to a donor board due to SEP binding.

4) Validation & delivery

• Perform targeted open-tests (Photos, Desktop/Documents, Mail, app libraries). Deliver verified data with a SHA-256 manifest. At the client’s request we can provision a bootable external macOS volume and migrate recovered data to a new Mac.

Outcome
The device revived cleanly; we unlocked the APFS container with the client’s credentials, imaged the Data volume, rebuilt the APFS object map from a pre-failure snapshot, and delivered a complete user profile (documents, photos, and libraries) with cryptographic integrity checks.

Process Guarantees (applies to all cases)

• Originals are never written to; all work is performed on forensic images.

• We document every step (chain-of-custody, tooling versions, hashes).

• If encryption is present, we require valid keys; when keys are unavailable we explain realistic carve-only limitations up-front.