Decode a Windows CE nand dump

Question

I am trying to decode and extract filesystem of NAND dump from broken device. Dump should't contain OOB. I tried to use eimgfs, but it didn't give any result. Any suggestions please, what am I doing wrong?

Answer 1

Windows CE runs in memory and isn't designed to be run from storage like normal Windows, the NAND chip only contains the binary to load into memory and sometimes the file to define the binary to load with device or image specific values. If you want a to pull the image, pull it from the RAM somehow, not NAND. It contains the OOBE and stuff because that's stuff from factory and can be accessed from a hard reset like power loss or a reset button. If you want to look into the NAND for fun then use the platform builder for your specific version and open the binary and you'll be able to look through the drivers and registry and stuff of that nature.