Data recovery from mobile devices; in this case Trimble Ranger TSC3CN

We were asked by a surveyor if we could recover the data from his defective Trimble Ranger. These devices work with flash memory and Windows Mobile. No data recovery company appeared to support this. A fun challenge for us again. The problem was also that the device had to continue to work, because the problem could be solved with a software upgrade (which, however, erased all data). So we had to be delicate.

We started by reading the flash memory of the Trimble. For this purpose, the memory chips were physically removed and read with an external reader. Then they were soldered back so that the device worked again. After analyzing the flash memory, it appears to work with the YAFFS2 (yet another flash file system) file system. A rather unusual file system with virtually no support.

In addition, it appears that Microsoft is not so strict with the YAFFS2 standard and has added its own modifications to it. In consultation with a colleague, this version of YAFFS2 was reverse engineered and a program was written to extract the files from the flash dumps. What is special here is that, as with all flash file systems, there is a piece of ECC code every few kilobytes.

This must also be taken into account if you want to avoid corrupt data. Ultimately, after weeks of patient programming, we were able to retrieve the data my customer needed. Wondering if we will encounter this YAFFS2 file system again. It would also be used in some Android devices.