Abstract:
This article suggests a low level approach for the examination of flash memories and describes low-level data acquisition methods for making full memory copies of flash memory devices. Artifacts, caused by flash specific operations likeblock erasing and wear leveling, are discussed and directions are given for enhanced data recovery and analysis on data originating from flash memory.
