All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 91 posts ]  Go to page Previous  1, 2, 3, 4, 5  Next
Author Message
 Post subject: Re: Cloning Tool
PostPosted: June 3rd, 2017, 18:51 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9796
Location: Australia
Could the data be encrypted?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Cloning Tool
PostPosted: June 3rd, 2017, 20:28 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 2975
Location: Adelaide, Australia
Why, in 4 pages of forum posts, was a model, make of card.. or even a photo not provided? Depending on the card, the lack of proper image means that chip off is only way. Just because the card somewhat works does not mean it is imageable. a cards firmware in some cases can be thought of as part of its hardware. meaning blocks of code are part of the running of the controller essential to properly reading/writing what is stored on the NAND.
Please before you return it, could you photo the card and put it up here for a bit more completeness to this thread?
It will add more context to people reading it in the future.
If you can convince customer, maybe try chip-off.

I am not just beating the chip-off drum, but know this is the next step after imaging fails.


Top
 Profile  
 
 Post subject: Re: Cloning Tool
PostPosted: June 4th, 2017, 0:56 
Offline

Joined: March 9th, 2017, 6:16
Posts: 67
Location: trinidad
Hi HaQue

I have attached snap of card , I have already given description of card in first post itself , besides in hddsuperclone snaps it is mentioned source as sandisk 64GB CF card and target 120 GB SAMSUNG EVO SSD
I disagree with you. Card may not have firmware issue as it can be imaged upto 99% , if some issue is there with MCU or any other code generally card shows less size and does not give access to sectors at all. Here we can check any sector in hex.
Only sectors where nand has defects cannot be read (first 600MB)


Attachments:
P_20170604_101303.jpg
P_20170604_101303.jpg [ 958.98 KiB | Viewed 1939 times ]
Top
 Profile  
 
 Post subject: Re: Cloning Tool
PostPosted: June 4th, 2017, 2:09 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9796
Location: Australia
I would retrieve the card's Identify Device information sector. Look for stuck data bits.

There is a table of Extended Error Codes on page 5-19 of the following manual:

SanDisk CompactFlash Memory Card OEM Product Manual:
http://pdfstream.manualsonline.com/2/23ba20e9-6aaf-4f79-a7d9-f78379489686.pdf

Attachment:
Request_Sense_Extended_Error_Codes.gif
Request_Sense_Extended_Error_Codes.gif [ 33.43 KiB | Viewed 1932 times ]


The above codes are accessed via the Request Sense (03h) ATA command.

The Execute Drive Diagnostic (90h) command (page 5-3) may or may not return some useful information.

Attachment:
Diagnostic_Codes.gif
Diagnostic_Codes.gif [ 9.69 KiB | Viewed 1932 times ]

There is also a Translate Sector (87h) command (page 5-23) which looks very interesting:

Quote:
When this command is issued, the controller responds with a 512-byte buffer of information on the desired cylinder, head and sector with the actual Logical Address.

Attachment:
CF_Translate_Sector_taskfile.gif
CF_Translate_Sector_taskfile.gif [ 14.76 KiB | Viewed 1933 times ]

Quote:
Table 5-33 represents the information in the buffer. This command is unique to SanDisk CompactFlash Memory cards.

Attachment:
CF_Translate_Sector_info.gif
CF_Translate_Sector_info.gif [ 8.77 KiB | Viewed 1933 times ]

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Cloning Tool
PostPosted: June 4th, 2017, 2:55 
Offline

Joined: March 9th, 2017, 6:16
Posts: 67
Location: trinidad
hi fzabkar
You have gone too deep in this case :D , appreciate all the efforts. Thank you.
I think if we got error codes from card that will clear where exact issue is.
I think I will have to connect card to CF > ATA adapter & thenn through serial adapater get terminal.
This is hell lot of exercise .I am sure I will not be able to make it.
Is there any other way to issue these commands or to check card ?
Thank You. Have a cheerful weekend


Top
 Profile  
 
 Post subject: Re: Cloning Tool
PostPosted: June 4th, 2017, 3:11 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9796
Location: Australia
Those commands are ATA commands. I believe PC3K should have an ATA terminal (not serial). Otherwise HDDSuperTool is probably a much better option.

I'm having difficulty understanding how an inaccessible block of LBAs from 0 to 0xFFFFF could be due to a hardware failure. The numbers are just too neat. In any case I believe that wear levelling would have distributed these LBAs over several chips, especially as the FATs would fall within this range, and these FATs would be updated each time a file is written.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Cloning Tool
PostPosted: June 4th, 2017, 5:09 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 2376
Location: CDRLabs @ Chandigarh [ India ]
Hello ,
In my recent experience i had a similar CF card .That card also i was able to image but could not find data .I did a chipoff with PC3K and recovered 100% data of the customer they were pictures .The main controller was SM Brand and There Were Two NAND Chips in That .It Could Be A Failed Controller Giving Out Garbage

PS : You said when controller fails it shows wrong size n all,This is not true in These CF Cards

_________________
Regards
Amarbir S Dhillon
CDRLabs Data Recovery - [ Chandigarh ,India ]
My Data Recovery Experiments - > https://www.facebook.com/chandigarhdatarecovery


Top
 Profile  
 
 Post subject: Re: Cloning Tool
PostPosted: June 4th, 2017, 7:44 
Offline
User avatar

Joined: February 9th, 2009, 16:13
Posts: 1935
Location: Ontario, Canada
I frequently get flash devices where you are really just reading a buffer and not the actual stored data. The cases are usually recoverable via direct access to the NAND and the typical chip off recovery procedures.

_________________
Luke
RAID Data Recovery


Top
 Profile  
 
 Post subject: Re: Cloning Tool
PostPosted: June 4th, 2017, 7:57 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 2975
Location: Adelaide, Australia
bunty wrote:
Hi HaQue

I have attached snap of card , I have already given description of card in first post itself , besides in hddsuperclone snaps it is mentioned source as sandisk 64GB CF card and target 120 GB SAMSUNG EVO SSD
I disagree with you. Card may not have firmware issue as it can be imaged upto 99% , if some issue is there with MCU or any other code generally card shows less size and does not give access to sectors at all. Here we can check any sector in hex.
Only sectors where nand has defects cannot be read (first 600MB)


ok, "Currently I am working on a 64GB memory card." is not a description. could have been sd, microsd, CF or anything. Sorry I didnt read the snaps.

When controller fails, one symptom is false size, but there are many other symptoms as well. One is not being able to access all NAND, or "believing" a NAND is bad. a single bad solder on a leg of a NAND or controller could make imaging fail, there is anything and everything and all in between. sometimes the card is showing data but it is all 00's or just replaying the same block, not what you think.

most NAND flash issues requiring recovery are never attributed to a cause with 100% accuracy.


Top
 Profile  
 
 Post subject: Re: Cloning Tool
PostPosted: June 4th, 2017, 9:46 
Offline

Joined: March 9th, 2017, 6:16
Posts: 67
Location: trinidad
A big Thanks to all contributors .
I learned a lot from this work. I have informed customer that the only option to recover data is by accessing Nand flash directly.
I am skeptical about approval though.
Thanks again.


Top
 Profile  
 
 Post subject: Re: Cloning Tool
PostPosted: June 4th, 2017, 10:29 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9796
Location: Australia
@bunty, AISI you haven't even begun to explore all the possibilities available to you before you start tearing the card apart.

IMHO you should start with an Identify Device command. This will return a 512-byte block of data that will have an 8-bit checksum of 0x00.

I would then test the Translate Sector (87h) command on a few LBAs, both inside and outside the "bad" range. If it produces plausible output, then I would write a HDDSuperTool script to build a Flash Translation Layer by matching each LBA with its chip/block/page location. This will hopefully obviate the need to build an FTL by mucking about with raw "chip-off" dumps.

To test the possibility that "you are really just reading a buffer and not the actual stored data", you could take a few random LBAs in your cloned image and then search the next few hundred megabytes for repetitions of these data. I would expect that a RAM buffer would not exceed 64MB.

ISTM the statement that "a single bad solder on a leg of a NAND or controller could make imaging fail" is not consistent with the symptoms. For a start, I would think that ECC would find these types of errors. Moreover, wear levelling would distribute such errors over random LBAs rather than a neat block. If there were a problem with the controller, then wouldn't it have trouble booting its firmware -- presumably this firmware is at least partially stored in NAND?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Cloning Tool
PostPosted: June 4th, 2017, 11:31 
Offline
User avatar

Joined: April 3rd, 2011, 0:19
Posts: 1708
Location: Providence, RI
bunty wrote:
Jared
You have loaded guns too early . I have nothing to do with softwares mentioned in thread . By looking at the thread its clear I am not sales representative of any software. like You I own a DR company. I am wondering how you conclude so much early. A DR pro. needs patience . Ha Ha Ha..


My apologies for misunderstanding your post. It seemed from the wording that it was almost comparing it to the other software and saying why it's so much better. That's why I prefaced my remark with the question: "Am I mistaken?" I couldn't tell what you were trying to say.

_________________
Hard Drive & RAID Data Recovery Services
https://www.data-medics.com/raid-data-recovery/


Top
 Profile  
 
 Post subject: Re: Cloning Tool
PostPosted: June 4th, 2017, 13:10 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 2376
Location: CDRLabs @ Chandigarh [ India ]
bunty wrote:
A big Thanks to all contributors .
I learned a lot from this work. I have informed customer that the only option to recover data is by accessing Nand flash directly.
I am skeptical about approval though.
Thanks again.


Bunty ,
100% its a chipoff case ,Just leave the possibility of getting data by the no of solutions suggested ,I have had many many cases now like this specifically for CF Cards

_________________
Regards
Amarbir S Dhillon
CDRLabs Data Recovery - [ Chandigarh ,India ]
My Data Recovery Experiments - > https://www.facebook.com/chandigarhdatarecovery


Top
 Profile  
 
 Post subject: Re: Cloning Tool
PostPosted: June 4th, 2017, 14:37 
Offline

Joined: January 29th, 2012, 1:43
Posts: 309
Location: United States
fzabkar wrote:
@bunty, AISI you haven't even begun to explore all the possibilities available to you before you start tearing the card apart.

IMHO you should start with an Identify Device command. This will return a 512-byte block of data that will have an 8-bit checksum of 0x00.

I would then test the Translate Sector (87h) command on a few LBAs, both inside and outside the "bad" range. If it produces plausible output, then I would write a HDDSuperTool script to build a Flash Translation Layer by matching each LBA with its chip/block/page location. This will hopefully obviate the need to build an FTL by mucking about with raw "chip-off" dumps.

To test the possibility that "you are really just reading a buffer and not the actual stored data", you could take a few random LBAs in your cloned image and then search the next few hundred megabytes for repetitions of these data. I would expect that a RAM buffer would not exceed 64MB.

ISTM the statement that "a single bad solder on a leg of a NAND or controller could make imaging fail" is not consistent with the symptoms. For a start, I would think that ECC would find these types of errors. Moreover, wear levelling would distribute such errors over random LBAs rather than a neat block. If there were a problem with the controller, then wouldn't it have trouble booting its firmware -- presumably this firmware is at least partially stored in NAND?

While all of this is technically true, there are replies from 3 reputable and experienced members that indicate that this will require a chip off recovery. While I am always as helpful as I can be when someone wishes to attempt further things with my tools, I do not think it is worth the effort in this case. My opinion is to consider it a chip off recovery, and not to try any of the complicated steps required to continue with software only recovery. But that is only my opinion.

If it was me, I would of course try everything possible before giving up. But that requires a very technical approach close to the programming level, being able to understand the results, and also being able to know when to give up.


Top
 Profile  
 
 Post subject: Re: Cloning Tool
PostPosted: June 4th, 2017, 16:11 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9796
Location: Australia
maximus wrote:
If it was me, I would of course try everything possible before giving up. But that requires a very technical approach close to the programming level, being able to understand the results, and also being able to know when to give up.

I don't see it that way. If the OP cannot obtain Identify Device data, then he is unlikely to be able to do anything remotely complicated.

A chip-off recovery requires physical-to-logical sector translation. Here is my pseudocode for HDDSuperTool:

Code:
for n = 0 to maxlba
  Translate Sector n
  extract chip/block/page data from output
  write LBA/chip/block/page to logfile
next n

The logfile is effectively the "translator". IIUC, it would be very useful for chip-off work, should that become necessary.

Examining the extended error codes for failed reads is mandatory, IMO. At the very least, one should do as much as possible to understand the problem before jumping to conclusions.

I have other ideas, but they depend on the OP's feedback.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Cloning Tool
PostPosted: June 4th, 2017, 19:03 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9796
Location: Australia
Some taskfiles to try ...

Code:
00 00 00 00 00 E0 EC  Identify Device
00 00 00 00 00 E0 03  Request Sense

00 00 00 00 00 E0 90  Execute Drive Diagnostic
00 00 00 00 00 E0 03  Request Sense

00 01 00 00 00 E0 20  Read Sector 0
00 00 00 00 00 E0 03  Request Sense

00 01 FF FF 0F E0 20  Read Sector 0xfffff
00 00 00 00 00 E0 03  Request Sense

00 01 00 00 10 E0 20  Read Sector 0x100000
00 00 00 00 00 E0 03  Request Sense

00 00 00 00 00 E0 87  Translate Sector 0
00 00 00 00 00 E0 03  Request Sense

00 00 FF FF 0F E0 87  Translate Sector 0xfffff
00 00 00 00 00 E0 03  Request Sense

00 00 00 00 10 E0 87  Translate Sector 0x100000
00 00 00 00 00 E0 03  Request Sense

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Cloning Tool
PostPosted: June 4th, 2017, 20:20 
Offline

Joined: January 29th, 2012, 1:43
Posts: 309
Location: United States
@fzabkar, if the OP wishes to try further, then it will be up to you to direct him. I may be willing to help some with the hddsupertool script coding, but I don't have the time to spend on it in detail.

In theory, since compact flash is ATA compliant, hddsupertool should be able to send ATA passthrough commands to it. To test this, the OP would need to open hddsupertool from the command line (terminal) on the live CD by typing "sudo hddsupertool". That will start it in a menu driven mode. Things such as identify device and read sectors can be done. And not to get any hopes up, but it looks like CF supports the read long command, which is an included script command. But the request sense and translate commands are not available options, without modifying/writing scripts.


Top
 Profile  
 
 Post subject: Re: Cloning Tool
PostPosted: June 4th, 2017, 20:47 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 2975
Location: Adelaide, Australia
The advice for a hard disk where the problem is not known would never be to continually power it on and try different things out of hope. I just hope whatever the issue is, is non-destructive.

It would be better to get a similar card, hone the skills required to get these commands working, then perform on patient.

If bunty is a DR Pro, or PC Shop, estimate around 5 hours and the revenue from the recovery will be less than time spent /$.

skills gained may be useful in future, no doubt. But usually the customer will not allow enough time for hobbyist type of exploration, and cancels recovery. I never understand that line of thinking though as the recovery will never happen with card put in a drawer after cancelling.


Top
 Profile  
 
 Post subject: Re: Cloning Tool
PostPosted: June 4th, 2017, 20:51 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 9796
Location: Australia
Read Long appears to be a dummy command.

Quote:
5.1.12 Read Long Sector -- 22H, 23H

The Read Long command performs similarly to the Read Sector(s) command except that it returns 516 bytes of data instead of 512 bytes. During a Read Long command, the card does not check the ECC bytes to determine if there has been a data error.Only single sector read long operations are supported. The transfer consists of 512 bytes of data transferred in word mode followed by 4 bytes of random data transferred in byte mode. Random data is returned instead of ECC bytes because of the nature of the ECC system used. This command has the same protocol as the Read Sector(s) command.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Cloning Tool
PostPosted: June 4th, 2017, 21:05 
Offline

Joined: January 29th, 2012, 1:43
Posts: 309
Location: United States
fzabkar wrote:
Read Long appears to be a dummy command.

Quote:
5.1.12 Read Long Sector -- 22H, 23H

The Read Long command performs similarly to the Read Sector(s) command except that it returns 516 bytes of data instead of 512 bytes. During a Read Long command, the card does not check the ECC bytes to determine if there has been a data error.Only single sector read long operations are supported. The transfer consists of 512 bytes of data transferred in word mode followed by 4 bytes of random data transferred in byte mode. Random data is returned instead of ECC bytes because of the nature of the ECC system used. This command has the same protocol as the Read Sector(s) command.

That states only the ECC data is random, so technically the main 512 bytes of data should be what is read. But that does not mean that it will return any usable data even on a good sector, only with testing can that be known...


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 91 posts ]  Go to page Previous  1, 2, 3, 4, 5  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: Exabot [Bot] and 40 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group