Garmin Nuvi 3490LM Research

[einstein9]

I have to admit this is one of the good cases i ever worked on..

Dead unit beyond repair, has a lot of saved info. & no backup
Took me really long time to research the FS structure

BGA-169 Sandisk 8GB SDIN5C

https://www.instagram.com/p/CvxKUOZtL2F/

Attachments

[fzabkar]

My Internet searches tell me that Garmin's Nuvis present a FAT FS when connected as USB mass storage devices.

[fzabkar]

That NAND chip is an eMMC. If it was intact, then a straight dump would have produced a file system, I would think.

There is a pinout for the 8GB version in the following circuit diagram (page :

http://www.friendlyelec.com.cn/dl/Schematic_NanoPC-4412_1312.pdf

This is the pinout for the 16G:

https://widora.cn/_media/zh/emmc.pdf

I have attached datasheets for the 4GB and 16GB versions.

Attachments

SDIN5C1-4G_16G-L.zip

(2.19 MiB) Downloaded 194 times

[einstein9]

My Internet searches tell me that Garmin's Nuvis present a FAT FS when connected as USB mass storage devices.

If this is as easy as you are presenting (internet search)

Are you ready to accept the case (shipping on me) and you do your magic and send us here your results.
you are the only one here who have all the necessary knowledge & tools i guess

[fzabkar]

I have no comment to make on your apparently successful data recovery. All I'm suggesting is that the file system is nothing special, as you seem to believe it is.

My research leads me to information such as the following URLs. The first explains how to switch the device from its default MTP communications mode to USB mass storage mode. When configured as a USB mass storage device, the OS is able to see the file system. In MTP mode, the device shields the FS from the OS.

Make NUVI DIR & Files visible for Backup:

https://forums.garmin.com/apps-software/mobile-apps-web/f/garmin-connect-web/61920/garmin-mass-storage-setting-and-changing-it-out-of-mtp-mode

How to 'Un-brick' a Garmin device the easy way [step by step]

https://www.austech.info/showthread.php/97627-How-to-Un-brick-a-Garmin-device-the-easy-way-step-by-step

Modern Garmin units have a visible file system. Older units such as StreetPilotc3x0, 26x0 or earlier and many GPSMAP models do not have such a system visible to a computer in Mass Storage Mode. Both types of units have the internal memory divided into 'regions' which contain pre-determined and very specific information for the unit or generic for the model series. In 'nuvi-type' units, the visible file system is formatted in FAT16 or FAT32 and is contained in region 48 or 83 depending on series age. One disadvantage in the 'file system' units such as nuvi series is that they are easier to 'brick' than the older types.

[einstein9]

Your research is based on a "Working Unit" the case i had was dead beyond repair, so chip-off & the research is your only friend
by having a look @the Sandisk BGA169 (make another research) needs some custom reading/dumping method

Then the story begins with decoding the NAND image and extracting its FS structure

FYI, its 8GB NAND. the 1st. 4GB is the OS FS and the other half is the user DATA (been mounted by MTP) <<------- in order to mount you need to decode 1st. part

Thats why it took me long time to research

Again, am asking you: Are you ready to accept this case reading the NAND and extracting its FS & data? (shipping on me)

[fzabkar]

Your research is based on a "Working Unit" ...

... which is how any intelligent researcher would normally approach such cases, if costs permit. At your Instagram link you state that it took you 1 month to determine the file system, whereas it took me only 2 minutes to do the same. My advice to you would be to research what is known about the device before embarking blindly into the unknown.

BTW, the only reason I embarked on my own research was because you declined to name the file system (because that's the kind of person that you are).

[einstein9]

Your research is based on a "Working Unit" ...

... which is how any intelligent researcher would normally approach such cases, if costs permit. At your Instagram link you state that it took you 1 month to determine the file system, whereas it took me only 2 minutes to do the same. My advice to you would be to research what is known about the device before embarking blindly into the unknown.

BTW, the only reason I embarked on my own research was because you declined to name the file system (because that's the kind of person that you are).

because i spent some of my time on it, and there is no such FREE School in my life... everybody should pay his school fees

Again, you are not answering the Question for the last time, will you accept the case and show us all your brain muscle?

[fzabkar]

I only became interested in this thread because I wanted to identify the file system that you wished to keep secret. I don't have any pro tools, as you well know, so I am in no position to play with a raw NAND dump. OTOH, if you can provide a dump of the chip taken via its eMMC interface, I would be interested in having a look.

[einstein9]

I only became interested in this thread because I wanted to identify the file system that you wished to keep secret. I don't have any pro tools, as you well know, so I am in no position to play with a raw NAND dump. OTOH, if you can provide a dump of the chip taken via its eMMC interface, I would be interested in having a look.

This is the important part, reading/dumping NAND

Anyway, trust my word my dear Its not as easy as it looks , i dumped this NAND more than 50 times, the last 2-3 attempts were properly well done

Have a great day

[fzabkar]

Were you paid for this job, or did you just do it for the intellectual satisfaction?

[einstein9]

Paid of course, one of the daily cases ,,,, and will be one of the Training Materials

[fzabkar]

You started off by saying that "It took me about 1 month to research the FS structure". Now you appear to be saying that the time was spent dumping the NAND. Which is it?

To me, "researching the FS structure" is something you do after you have achieved a good NAND dump.

In any case, since this was a paid job, I would have short-circuited the reverse engineering effort by obtaining a working GPS and dumping the NAND via its eMMC interface. Then you could research the FS in preparation for your attack on the non-working unit. The way you have approached the job is to throw all the jigsaw pieces on the table and then reassemble them without knowing what the final picture looks like.

[sin]

Hello einstein9,
Can you please elaborate on the difficulty you found while reading this EMMC. There can be always special cases and it would be an honor to know.
Why did you have to re dump plenty of times and what were the differences?

--

[fzabkar]

@sin, here is a used, working GPS for US$30:

https://www.ebay.com/p/141018716

[sin]

Cool thanks. Import of GPS systems in India requires lot of paper work. If its second hand then it has to be certified by a Charted Engineer.

I guess long back I had 3 such pieces in my house when things were relaxed. Let me find if I still have them

--

[einstein9]

Hello einstein9,
Can you please elaborate on the difficulty you found while reading this EMMC. There can be always special cases and it would be an honor to know.
Why did you have to re dump plenty of times and what were the differences?

--

Hi, have a look here for example: https://multi-recovery.com/subpages/MRTYPE7.php used for this Sandisk NAND

My Case Sandisk BGA-169 needs special reading setting/methods (similar to this Adapter) to have a proper reading (since you are in Flash DR field you know this already Others just keep talking, No tools No experience equipped with a PC+Internet & Browser to search and post results here )

what am saying in short that It took me some time to figure out something similar to this adapter solution which does the same job (longer path but same destination)
after many failed attempts got succeeded. 1 month, 50 times is a figure of speech not very important i think

[Arch Stanton]

Hello einstein9,
Can you please elaborate on the difficulty you found while reading this EMMC. There can be always special cases and it would be an honor to know.
Why did you have to re dump plenty of times and what were the differences?

--

Hi, have a look here for example: https://multi-recovery.com/subpages/MRTYPE7.php used for this Sandisk NAND

My Case Sandisk BGA-169 needs special reading setting/methods (similar to this Adapter) to have a proper reading (since you are in Flash DR field you know this already Others just keep talking, No tools No experience equipped with a PC+Internet & Browser to search and post results here )

what am saying in short that It took me some time to figure out something similar to this adapter solution which does the same job (longer path but same destination)
after many failed attempts got succeeded. 1 month, 50 times is a figure of speech not very important i think

I didn't mean to get into this, but your initial post specifically said "Took me really long time to research the FS structure", so fzabkar's point "isn't it simply exFAT?" is very understandable. Further fzabkar is hardly someone that 'just reads in the internet and then posts results here', you only have to have one look at the myriad of utilities he produced, up for grabs, on his website.

You could also simply say "my mistake, I said FS research, it was actually about trying to read the darned thing" without taking cheap shots and innuendo.