Innogrit SSD Data Recovery

Root Cause: Defective NAND Page Handling

The IG5236's quad-core Cortex-R5 firmware manages concurrent operations across 8 NAND channels. Under sustained mixed I/O (simultaneous random reads, sequential writes, & background garbage collection), the controller encounters a defective NAND page during a program operation. The error handler for that defective page triggers a buffer overflow in the firmware's internal command queue.

The overflow corrupts the module tables stored in the controller's working memory. The firmware detects the corruption, aborts all pending operations, & drops to a factory diagnostic state. The drive reverts to its silicon descriptor ("MN-5236") and reports a 2.1GB diagnostic capacity instead of the drive's real size. This panic is permanent; power cycling doesn't clear it. The corrupted module tables must be bypassed through PC-3000 SSD's InnoGrit Utility.

ADATA SSD Toolbox "60% Bug"

A specific trigger for the MN-5236 panic is the ADATA SSD Toolbox Quick Diagnostic Scan. The scan generates a pattern of mixed I/O that hits the IG5236's buffer overflow vulnerability. Users report the scan freezes at 60% progress, then the drive enters MN-5236 state permanently.

The 60% freeze point isn't arbitrary. At that stage, the Toolbox transitions from sequential read verification to random mixed I/O stress testing. The IG5236's firmware encounters the defective-page condition during this transition, triggers the overflow, & locks. The ADATA XPG Gammix S70 Blade is the most frequently affected drive. If your drive shows MN-5236 after running the ADATA Toolbox, don't run the Toolbox again or attempt firmware reflashing. Both actions risk overwriting the existing NAND data structure.

Power Loss Recovery Loop

After an unclean shutdown (power failure, forced restart, BSoD), the IG5236 enters a recovery routine that can take 30+ seconds. The controller attempts to reconcile its FTL state by scanning NAND metadata & verifying committed writes against the DRAM-cached mapping table stored in the reserved service area.

If the user interrupts this recovery routine by power cycling again before it completes, the controller must restart the reconciliation from scratch with an additional layer of corruption. Repeated power cycling compounds the FTL damage. Each interrupted recovery attempt adds another layer of corruption until the controller enters permanent firmware panic. The drive becomes undetectable on the PCIe bus.

Repeated thermal cycling (high temperature during sustained writes, ambient temperature at idle) causes micro-fractures in the BGA solder balls connecting the IG5236 to the M.2 PCB. These fractures are invisible to the naked eye. The drive may work intermittently for weeks before failing permanently. FLIR thermal imaging at our Austin, TX lab reveals the fractured joints as cold spots against the controller's normal heat signature.

PMIC burnout is the second thermal failure mode. The PMIC (power management IC) regulates voltage to the controller & NAND packages. When sustained heat exceeds its thermal limits, it shorts. A shorted PMIC draws excess current and prevents the controller from booting. FLIR shows the failed PMIC as a thermal hotspot at idle. Repair requires desoldering the failed PMIC with an Atten 862 hot air rework station & replacing it with a Hakko FM-2032 on an FM-203 base station.

Why Board Repair IS Data Recovery for Encrypted SSDs

Most data recovery labs outsource board-level failures or declare them unrecoverable. We don't. We locate the failed component using FLIR thermal imaging, replace the shorted PMIC or damaged capacitor with a Hakko FM-2032, & bring the original controller back to life. When the controller boots, the AES-256 encryption keys are intact & your data is accessible through PC-3000.

Board repair isn't a separate service from data recovery for Innogrit SSDs. The encryption keys are fused to the controller silicon. If the controller is dead, chip-off yields only ciphertext. Reviving the original controller is the only recovery path. NVMe board repair: $600–$900.

Per-Controller Key Binding, Not Per-Firmware

The AES-256 media encryption key on an Innogrit SSD is generated dynamically by the controller's random bit generator and wrapped by a key encryption key derived from a hardware-unique root key that is fused into the controller silicon during fabrication. The wrapped media key is held in a reserved system area of NAND; the hardware-unique root key cannot be read back off the die. A donor IG5236 controller carries a different hardware-unique root key and cannot derive the key encryption key needed to unwrap the original media key. Transplanting the donor controller onto the original PCB produces a drive that powers on, enumerates correctly, and returns ciphertext on every LBA read.

Swapping the whole PCB (donor board with its own donor controller, with the customer's NAND packages moved over) fails for the same reason. The donor controller cannot decrypt the original NAND because it cannot unwrap the media key. The controller has no fallback path: there is no vendor-specific "decrypt with alternate key" NVMe command, and no way to re-sign the NAND with the donor's key without already having the plaintext.

The only recovery path that preserves the media key is the one the existing controller chip is on. Board-level repair revives the original silicon: replace the shorted PMIC with a Hakko FM-2032, re-bond a fractured BGA ball using an Atten 862 hot air station and a Zhuo Mao BGA rework platform, restore the failed voltage rail, and let the original controller boot with its key hierarchy intact. At that point, the drive can decrypt and serve LBAs normally. NVMe board repair starts at $600–$900; a donor drive is a matching ssd used for its circuit board. typical donor cost: $40–$100 for common models, $150–$300 for discontinued or rare controllers. +$100 rush fee to move to the front of the queue.

SLC Cache Collapse on DRAM-less IG5220 HMB Drives

The second failure mode worth isolating is SLC cache exhaustion on the IG5220 RainierQX, a DRAM-less Gen4 controller that relies on Host Memory Buffer to hold the FTL working set. IG5220 drives ship with a dynamic pSLC cache: a fraction of the TLC or QLC NAND is operated in pseudo-SLC mode to absorb burst writes at advertised sequential speeds. When the host sustains a write workload longer than the cache can fold back into native TLC, the controller stalls.

Under normal thermal and firmware conditions, the stall is benign: throughput drops to native TLC write speed and the drive keeps serving commands. The failure case is when the firmware cache manager has a defect that mishandles the fold-back transition. On affected IG5220 firmware revisions, a sustained write past the pSLC cache boundary can leave the FTL journal in an inconsistent state. The drive then enters BSY (busy) on the next power cycle and enumerates with a reduced or debug-mode capacity footprint, analogous to the IG5236 MN-5236 controller panic signature documented on ADATA S70 Blade drives.

Recovery is constrained by tool support. The ACELAB PC-3000 SSD supported controller matrix does not currently include a firmware-level Active Utility for Innogrit IG5216, IG5220, or IG5236 architectures. That means no loader injection, no technological-mode FTL reconstruction, and no vendor-utility path comparable to what exists for Phison or Silicon Motion controllers. Recovery on an Innogrit drive with a confirmed FTL fault reduces to board-level hardware stabilization (PMIC replacement, BGA rework, voltage rail repair) to revive the original controller so its own firmware can rebuild state on the next boot. See firmware corruption recovery for the generalized workflow across controller families where active utilities do exist.

How Channel Count Affects Recovery Scan Time

During FTL reconstruction, PC-3000 SSD reads every physical NAND page to extract LBA stamps & sequence numbers from the spare area. More channels mean more parallel reads. On the IG5236, the InnoGrit Utility scans 8 NAND channels concurrently at 1200 MT/s, reading up to 8 Chip Enable lines per channel in the 15mm FCBGA package. A 2TB drive with 16 NAND dies completes its page scan faster than the same capacity on a 4-channel IG5220.

The IG5220 offsets its 4-channel limitation with double the interface speed: 2400 MT/s per channel via ONFI 5.0. Raw bandwidth is comparable to the IG5236, but the reduced parallelism means the controller can't interleave as many concurrent read operations. In practice, the reduced channel count means FTL reconstruction on an IG5220-based drive generally takes longer than the same job on an IG5236 with equivalent NAND capacity.

Primary FTL Table & Journal Model

The primary FTL table is a complete logical-to-physical address map stored in reserved NAND service area blocks. On the IG5236, this table loads into DDR4 DRAM at boot. On the IG5220 & IG5216, it loads into the host PC's RAM via Host Memory Buffer. The table is large: a 2TB drive with 4KB LBA granularity requires roughly 2 billion L2P entries.

The journal is a sequential log of every L2P mapping change since the last full FTL flush. When the controller writes a new NAND page, it appends the updated L2P entry to the journal instead of rewriting the entire primary table. Periodically, the controller flushes the accumulated journal entries into the primary table & commits the updated table to NAND. Between flushes, the working FTL is the primary table plus the journal.

Three Corruption Pathways

1. Power loss during journal flush. The controller is in the middle of committing journal entries to the primary FTL table in NAND. A power cut interrupts the write. The primary table now has a mix of old & new entries with no way to determine which entries committed successfully. On the IG5220 & IG5216, the journal in host RAM is lost entirely when the PCIe link drops.
2. Bad block in the metadata NAND partition. The NAND blocks reserved for FTL storage are not immune to cell degradation. If a bad block develops in the service area where the primary FTL table is stored, the controller can't read its own mapping data. The LDPC engine attempts correction, but if the error count exceeds the correction threshold, the affected FTL region is unreadable. The controller can't boot.
3. Thermal event during active NAND programming. The IG5236 draws up to 3W peak power on 12nm FinFET. Sustained writes in an unventilated M.2 slot push junction temperatures past the NAND's rated maximum. A thermal event during an active FTL journal flush can corrupt both the in-flight write & the NAND page being programmed. The IG5220 at 2.5W peak is less susceptible but not immune.

Why FTL Corruption Bricks the Drive

User data corruption affects individual files. FTL metadata corruption affects every file. The FTL is the index that tells the controller where everything is stored in NAND. Without it, 2TB of NAND pages is an unsorted pile of data fragments with no address map.

On boot, the Innogrit controller runs an integrity check on the FTL structure. If the primary table is damaged & the journal can't reconcile the corruption, the controller aborts initialization & drops to its silicon descriptor. That's the MN-5236 state: the controller isn't dead, but it refuses to present user data because it can't trust its own map. PC-3000 SSD's InnoGrit Utility rebuilds the FTL from scratch using spare area metadata on each NAND page, bypassing the corrupted primary table entirely. NVMe SSD recovery for FTL corruption: $900–$1,200.