Conclusion

So, there you have it: a NAND-reader for 3.3V 8bit NAND flash chips for about EUR30 worth of components. It's not lightning fast or feature-rich yet, but it can be expanded to be. It was useful for me: I managed to read out the NAND chip I built it for.

The software (for Linux) is available, as usual, under the GPLv3. If you manage to upgrade it or make it faster, I'd appreciate a note. Update: some people already have been working on improvements, an example is Bjoern Kerlers work.

One last note: If you have a broken SD-card or USB-stick and think you can recover it using this, be warned: reading out the flash (with a tool like this) only is half the work. As soon as you have an image, you'll still need to know how to interpret it: most flash chips do bad block management and/or will swap sectors around for wear leveling. Unfortunately, I know of no free or cheap tool to undo that yet.

« Prev 4

24 comments

Raza wrote at 28 Mar 2019, 8.57:

Hi i am hobbyist learning i tried to build nand reader with teac card reader CA-200 I have made connections from card reader to TSOP-48 adapter now I am trying to read the nand flash please guide me what should I do next

FoxMoulder wrote at 25 Apr 2018, 12.39:

Hello, It's great job. Somebody knows How many time to download 4GB beacause for me it's arroud 15 minutes. Thanks

Donovan wrote at 17 Aug 2017, 11.49:

@kiko: The numbers are correct it's just the naming of the ports which is incorrect. Just lookup the device specification of ft2232 and compare with your board. For the physical connection I've soldered a breadboard adapter.

kiko wrote at 24 Jul 2017, 20.33:

@Donovan, I have the same Chinese chip, how do you connect it to the TSOP48 adapter? thanks

Donovan wrote at 21 Jul 2017, 21.22:

I've been scratching my head for a long while until I realized that the cheap chinese FT2232H board was the source of confusion. They just named the ports ADBUS, BDBUS, CDBUS and DDBUS which has nothing in common with the FT2232H naming :-( *facepalm* Anyway, now it works and it's really awesome. Thanks sprite_tm for all the inspiration on these pages (...and the new opportunities that open up for me)!

Lukasz wrote at 17 Jan 2017, 11.29:

Hi. This will work with 29f64g08FACA chip as program not recognise (not see) chip?? I try on Linux and windows.

John Doe wrote at 16 Oct 2016, 20.13:

Kinda asskicking project! Thanks!!!

andre wrote at 12 Jul 2016, 6.05:

is this likely to work for large ie 16GB chips? have a dead mp4 player here with a bad flash chip

tsekman wrote at 21 Mar 2014, 18.29:

very useful. i am trying to read a nand chip with 8 bytes ID. i have collect some info from the internet about chipsize, datasize, and blocksize. no luck with oobsize and no datasheet. if i return the values i have found (with an incorrect value for oobsize) through NandID.cpp and execute the commant -t main -r imagefile should i read the data correct?

Bilbo wrote at 12 Feb 2014, 12.04:

Which version of libftdi should I use? I've some problems with compilation (linking).

renne_t wrote at 16 Feb 2013, 17.58:

did you manage to write to the nand yet ?

ftw wrote at 3 Nov 2012, 11.01:

Fantastic work ! What linux distribution do you recomend to compile this application ? I am using Tinycore and the "libftdi" that comes with this distribution but i got some errors: 1. main.cpp line 45 "); missing 2. ftdinand.cpp lines 112 and 113 div_by_5 not defined, i replaced them with "0" and "1" 3. makefile line 3 some errors locating libftdi.so 4. ftdinand.cpp lots of errors "undefined reference to ftdi_xxx_xxxxxx"

Adrian wrote at 26 Oct 2012, 20.32:

Very interesting ! This reader only support 8 bit chips. Any chance to add 16 bit support ?

Neo wrote at 24 Oct 2012, 21.13:

Hi, thanks you very much for your sharing. @Jarni, could you give more détail on your project about FT245R. Could you have link to read more info. thanks

Jarni wrote at 6 Oct 2012, 22.53:

I made the same project using FT245R. http://www.imagebam.com/image/97c7ba213852728 I can read the data from a NAND chip of a pendrive but I can't find the FAT....

Sprite_tm wrote at 27 Sep 2012, 21.18:

Rmy: It probably needed the specific SM flashlayout and borked when your NAND didn't provide that. The caps are for decoupling, it probably works without but I'd advise against it. The device is recognised as a USB-to-serial converter, but the tool I built connects to it over USB directly, bypassing the serial part. It'll read the NAND-flash for you and will spit the contents out in binary.

Rmy wrote at 27 Sep 2012, 8.40:

First, Well done ! So long time ago I was looking for something like that. I already tried to transform a card reader but had no result, perhaps the controller was too old. I've made my command on ebay for a card you mentioned, and I wonder : 1/ Do I need to put the 2 caps between 3.3 and nand in that case ? What is the utility ? 2/ How is it recognized when usb is plugged ? I mean, is it a serial device, or a standard block device accessible by dd, dcfldd or ddrescue ?

hardcorefs wrote at 25 Sep 2012, 6.31:

"Also, I started writing some software tools to do block rotations, and other stuff needed to recover the filesystem from raw image" You have two issues: 1. the embedded file system 2. The block management system. They can be completely independent of each other, depending on if the device is utilizing an embedded controller. in which case issue 2 is dependent on the chip manufacturer, I know of a tleast one Chinese manufacturer that deliberately jiggles some bytes, each time they issue an updated batch of chips. So even if the controller has the same part number, you can end up with corrupted extracted data.

bjax wrote at 21 Sep 2012, 23.11:

Yup you're right, they're going through the jtag on the motherboard, so they would have a controller for that, I would also assume that the software used for that wouldn't help. But for the ps3 I've seen modders solder directly to the nand chips. Here's a tutorial about a progskeet programmer, http://www.progskeet.com/forum/viewtopic.php?f=3&t=3749

Sprite_tm wrote at 21 Sep 2012, 9.00:

Mike: Movinand seems mmc-compatible, you may want to try hooking it up to something that can read mmc's. bjax: On the xbox360, I know they use an SPI interface to the chip the NAND is connected to to program it. For the PS3, I'm not sure what they use.

bjax wrote at 21 Sep 2012, 6.57:

How do the nand programmers used for modding xbox 360s and ps3s work? Also could any of their modding tools help in this case? I wouldn't even know where to start, but was just curious. bjax

mike wrote at 20 Sep 2012, 20.43:

Any chance this could be modified to read off a movinand flash chip?There is a commercial reader for it but it's really expensive.

Leo wrote at 20 Sep 2012, 16.21:

Also, I started writing some software tools to do block rotations, and other stuff needed to recover the filesystem from raw image, but they are heavily untested. When I do make them work, I'll share it.

Leo wrote at 20 Sep 2012, 16.18:

This is totally awesome! You probably saved my life! I've got a dead pendrive with password safe on it, and I was just about to start hacking on some ARM chip to pull the data off the memory via USB.

FT2232H NAND flash reader - Conclusion

Conclusion