Main » Forums home » Flash storage, SSD

All times are UTC - 5 hours [ DST ]



Post new topic Reply to topic  Page 1 of 1
  [ 8 posts ] 
  Print view Previous topic | Next topic 
Author Message
ddrecovery
 Post subject: Monolith - Repeating Hex Data
PostPosted: March 31st, 2016, 19:50 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1710
Location: Phoenix, AZ USA
Anyone seen this on a Monolith?

The drive has a repeating pattern of FF's for several thousand sectors, then a repeating pattern of data (sector based). Then goes back to FF for a few thousand sectors before a different repeating pattern starts. Interestingly the data pattern starts at sector 1024. Is this worth a pin-out (probably not), I presume its maybe a virus? Flash drive does give the correct volume.
Code:
Sector 199423

  615FE00:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FE10:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FE20:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FE30:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FE40:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FE50:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FE60:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FE70:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FE80:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FE90:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FEA0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FEB0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FEC0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FED0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FEE0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FEF0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FF00:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FF10:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FF20:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FF30:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FF40:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FF50:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FF60:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FF70:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FF80:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FF90:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FFA0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FFB0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FFC0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FFD0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FFE0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FFF0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

Sector 199424

  6160000:  EB 36 08 82 13 6D 10 04 - 26 DA 20 08 4C B4 41 10  ë6.‚.m..&Ú .L´A.
  6160010:  98 68 83 20 30 D1 06 41 - 60 A2 0D 82 05 44 1B 04  .hƒ 0Ñ.A`¢.‚.D..
  6160020:  0A 88 36 08 14 10 6D 10 - 28 20 DA 20 50 40 B4 41  ..6...m.( Ú P@´A
  6160030:  A0 80 68 83 85 01 D1 06 - 0A 03 A2 0D 14 06 44 1B   .hƒ….Ñ...¢...D.
  6160040:  28 0C 88 36 50 18 10 6D - A0 30 20 DA 85 61 40 B4  (..6P..m 0 Ú…a@´
  6160050:  CF C3 80 68 9E 87 01 D1 - F9 0F 03 A2 37 1F 06 44  ÏÃ.hž‡.Ñù..¢7..D
  6160060:  6E 3E 0C 88 19 7C 18 10 - 32 F8 30 20 64 F0 61 40  n>...|..2ø0 dða@
  6160070:  C8 E0 C3 80 55 C1 87 01 - AA 82 0F 03 54 05 1F 06  ÈàÃ.UÁ‡.ª‚..T...
  6160080:  A8 0A 3E 0C 50 15 7C 18 - A0 2A F8 30 40 55 F0 61  ¨.>.P.|. *ø0@Uða
  6160090:  80 AA E0 C3 C5 55 C1 87 - 4F AB 82 0F 9E 56 05 1F  .ªàÃÅUÁ‡O«‚.žV..
  61600A0:  3C AD 0A 3E 78 5A 15 7C - F0 B4 2A F8 25 69 55 F0  <..>xZ.|ð´*ø%iUð
  61600B0:  8F D2 AA E0 DB A5 55 C1 - 73 4B AB 82 23 96 56 05  .ÒªàÛ¥UÁsK«‚#–V.
  61600C0:  46 2C AD 0A 8C 58 5A 15 - 18 B1 B4 2A 30 62 69 55  F,..ŒXZ..±´*0biU
  61600D0:  60 C4 D2 AA 05 88 A5 55 - 0A 10 4B AB D1 20 96 56  `ÄÒª..¥U..K«Ñ –V
  61600E0:  A2 41 2C AD 81 83 58 5A - 02 07 B1 B4 C1 0E 62 69  ¢A,..ƒXZ..±´Á.bi
  61600F0:  82 1D C4 D2 C1 3B 88 A5 - 47 77 10 4B 8E EE 20 96  ‚.ÄÒÁ;.¥Gw.KŽî –
  6160100:  D9 DD 41 2C B2 BB 83 58 - 64 77 07 B1 0D EE 0E 62  ÙÝA,²»ƒXdw.±.î.b
  6160110:  1A DC 1D C4 F1 B8 3B 88 - 27 71 77 10 4E E2 EE 20  .Ü.Äñ¸;.'qw.Nâî
  6160120:  9C C4 DD 41 38 89 BB 83 - B5 12 77 07 6A 25 EE 0E  œÄÝA8‰»ƒµ.w.j%î.
  6160130:  D4 4A DC 1D A8 95 B8 3B - 50 2B 71 77 A0 56 E2 EE  ÔJÜ.¨•¸;P+qw Vâî
  6160140:  85 AD C4 DD CF 5B 89 BB - 5B B7 12 77 B6 6E 25 EE  ….ÄÝÏ[‰»[·.w¶n%î
  6160150:  A9 DD 4A DC 97 BB 95 B8 - EB 77 2B 71 D6 EF 56 E2  ©ÝJÜ—»•¸ëw+qÖïVâ
  6160160:  69 DF AD C4 17 BE 5B 89 - EB 7C B7 12 D6 F9 6E 25  iß.Ä.¾[‰ë|·.Öùn%
  6160170:  AC F3 DD 4A 58 E7 BB 95 - 75 CE 77 2B EA 9C EF 56  ¬óÝJX绕uÎw+êœïV
  6160180:  D4 39 DF AD 6D 73 BE 5B - DA E6 7C B7 71 CD F9 6E  Ô9ß.ms¾[Úæ|·qÍùn
  6160190:  E2 9A F3 DD 01 35 E7 BB - C7 6A CE 77 8E D5 9C EF  âšóÝ.5ç»ÇjÎwŽÕœï
  61601A0:  D9 AB 39 DF 77 57 73 BE - 2B AE E6 7C 56 5C CD F9  Ù«9ßwWs¾+®æ|V\Íù
  61601B0:  69 B8 9A F3 17 70 35 E7 - EB E0 6A CE 13 C1 D5 9C  i¸šó.p5çëàjÎ.ÁÕœ
  61601C0:  E3 82 AB 39 C6 05 57 73 - 8C 0B AE E6 DD 17 5C CD  ã‚«9Æ.WsŒ.®æÝ.\Í
  61601D0:  7F 2F B8 9A 3B 5E 70 35 - 76 BC E0 6A EC 78 C1 D5  ./¸š;^p5v¼àjìxÁÕ
  61601E0:  1D F1 82 AB FF E2 05 57 - FE C5 0B AE 39 8B 17 5C  .ñ‚«ÿâ.WþÅ.®9‹.\
  61601F0:  72 16 2F B8 21 2C 5E 70 - 42 58 BC E0 41 B0 78 C1  r./¸!,^pBX¼àA°xÁ

Sector 199425

  6160200:  EB 36 08 82 13 6D 10 04 - 26 DA 20 08 4C B4 41 10  ë6.‚.m..&Ú .L´A.
  6160210:  98 68 83 20 30 D1 06 41 - 60 A2 0D 82 05 44 1B 04  .hƒ 0Ñ.A`¢.‚.D..
  6160220:  0A 88 36 08 14 10 6D 10 - 28 20 DA 20 50 40 B4 41  ..6...m.( Ú P@´A
  6160230:  A0 80 68 83 85 01 D1 06 - 0A 03 A2 0D 14 06 44 1B   .hƒ….Ñ...¢...D.
  6160240:  28 0C 88 36 50 18 10 6D - A0 30 20 DA 85 61 40 B4  (..6P..m 0 Ú…a@´
  6160250:  CF C3 80 68 9E 87 01 D1 - F9 0F 03 A2 37 1F 06 44  ÏÃ.hž‡.Ñù..¢7..D
  6160260:  6E 3E 0C 88 19 7C 18 10 - 32 F8 30 20 64 F0 61 40  n>...|..2ø0 dða@
  6160270:  C8 E0 C3 80 55 C1 87 01 - AA 82 0F 03 54 05 1F 06  ÈàÃ.UÁ‡.ª‚..T...
  6160280:  A8 0A 3E 0C 50 15 7C 18 - A0 2A F8 30 40 55 F0 61  ¨.>.P.|. *ø0@Uða
  6160290:  80 AA E0 C3 C5 55 C1 87 - 4F AB 82 0F 9E 56 05 1F  .ªàÃÅUÁ‡O«‚.žV..
  61602A0:  3C AD 0A 3E 78 5A 15 7C - F0 B4 2A F8 25 69 55 F0  <..>xZ.|ð´*ø%iUð
  61602B0:  8F D2 AA E0 DB A5 55 C1 - 73 4B AB 82 23 96 56 05  .ÒªàÛ¥UÁsK«‚#–V.
  61602C0:  46 2C AD 0A 8C 58 5A 15 - 18 B1 B4 2A 30 62 69 55  F,..ŒXZ..±´*0biU
  61602D0:  60 C4 D2 AA 05 88 A5 55 - 0A 10 4B AB D1 20 96 56  `ÄÒª..¥U..K«Ñ –V
  61602E0:  A2 41 2C AD 81 83 58 5A - 02 07 B1 B4 C1 0E 62 69  ¢A,..ƒXZ..±´Á.bi
  61602F0:  82 1D C4 D2 C1 3B 88 A5 - 47 77 10 4B 8E EE 20 96  ‚.ÄÒÁ;.¥Gw.KŽî –
  6160300:  D9 DD 41 2C B2 BB 83 58 - 64 77 07 B1 0D EE 0E 62  ÙÝA,²»ƒXdw.±.î.b
  6160310:  1A DC 1D C4 F1 B8 3B 88 - 27 71 77 10 4E E2 EE 20  .Ü.Äñ¸;.'qw.Nâî
  6160320:  9C C4 DD 41 38 89 BB 83 - B5 12 77 07 6A 25 EE 0E  œÄÝA8‰»ƒµ.w.j%î.
  6160330:  D4 4A DC 1D A8 95 B8 3B - 50 2B 71 77 A0 56 E2 EE  ÔJÜ.¨•¸;P+qw Vâî
  6160340:  85 AD C4 DD CF 5B 89 BB - 5B B7 12 77 B6 6E 25 EE  ….ÄÝÏ[‰»[·.w¶n%î
  6160350:  A9 DD 4A DC 97 BB 95 B8 - EB 77 2B 71 D6 EF 56 E2  ©ÝJÜ—»•¸ëw+qÖïVâ
  6160360:  69 DF AD C4 17 BE 5B 89 - EB 7C B7 12 D6 F9 6E 25  iß.Ä.¾[‰ë|·.Öùn%
  6160370:  AC F3 DD 4A 58 E7 BB 95 - 75 CE 77 2B EA 9C EF 56  ¬óÝJX绕uÎw+êœïV
  6160380:  D4 39 DF AD 6D 73 BE 5B - DA E6 7C B7 71 CD F9 6E  Ô9ß.ms¾[Úæ|·qÍùn
  6160390:  E2 9A F3 DD 01 35 E7 BB - C7 6A CE 77 8E D5 9C EF  âšóÝ.5ç»ÇjÎwŽÕœï
  61603A0:  D9 AB 39 DF 77 57 73 BE - 2B AE E6 7C 56 5C CD F9  Ù«9ßwWs¾+®æ|V\Íù
  61603B0:  69 B8 9A F3 17 70 35 E7 - EB E0 6A CE 13 C1 D5 9C  i¸šó.p5çëàjÎ.ÁÕœ
  61603C0:  E3 82 AB 39 C6 05 57 73 - 8C 0B AE E6 DD 17 5C CD  ã‚«9Æ.WsŒ.®æÝ.\Í
  61603D0:  7F 2F B8 9A 3B 5E 70 35 - 76 BC E0 6A EC 78 C1 D5  ./¸š;^p5v¼àjìxÁÕ
  61603E0:  1D F1 82 AB FF E2 05 57 - FE C5 0B AE 39 8B 17 5C  .ñ‚«ÿâ.WþÅ.®9‹.\
  61603F0:  72 16 2F B8 21 2C 5E 70 - 42 58 BC E0 41 B0 78 C1  r./¸!,^pBX¼àA°xÁ

Sector 199426

  6160400:  EB 36 08 82 13 6D 10 04 - 26 DA 20 08 4C B4 41 10  ë6.‚.m..&Ú .L´A.
  6160410:  98 68 83 20 30 D1 06 41 - 60 A2 0D 82 05 44 1B 04  .hƒ 0Ñ.A`¢.‚.D..
  6160420:  0A 88 36 08 14 10 6D 10 - 28 20 DA 20 50 40 B4 41  ..6...m.( Ú P@´A
  6160430:  A0 80 68 83 85 01 D1 06 - 0A 03 A2 0D 14 06 44 1B   .hƒ….Ñ...¢...D.
  6160440:  28 0C 88 36 50 18 10 6D - A0 30 20 DA 85 61 40 B4  (..6P..m 0 Ú…a@´
  6160450:  CF C3 80 68 9E 87 01 D1 - F9 0F 03 A2 37 1F 06 44  ÏÃ.hž‡.Ñù..¢7..D
  6160460:  6E 3E 0C 88 19 7C 18 10 - 32 F8 30 20 64 F0 61 40  n>...|..2ø0 dða@
  6160470:  C8 E0 C3 80 55 C1 87 01 - AA 82 0F 03 54 05 1F 06  ÈàÃ.UÁ‡.ª‚..T...
  6160480:  A8 0A 3E 0C 50 15 7C 18 - A0 2A F8 30 40 55 F0 61  ¨.>.P.|. *ø0@Uða
  6160490:  80 AA E0 C3 C5 55 C1 87 - 4F AB 82 0F 9E 56 05 1F  .ªàÃÅUÁ‡O«‚.žV..
  61604A0:  3C AD 0A 3E 78 5A 15 7C - F0 B4 2A F8 25 69 55 F0  <..>xZ.|ð´*ø%iUð
  61604B0:  8F D2 AA E0 DB A5 55 C1 - 73 4B AB 82 23 96 56 05  .ÒªàÛ¥UÁsK«‚#–V.
  61604C0:  46 2C AD 0A 8C 58 5A 15 - 18 B1 B4 2A 30 62 69 55  F,..ŒXZ..±´*0biU
  61604D0:  60 C4 D2 AA 05 88 A5 55 - 0A 10 4B AB D1 20 96 56  `ÄÒª..¥U..K«Ñ –V
  61604E0:  A2 41 2C AD 81 83 58 5A - 02 07 B1 B4 C1 0E 62 69  ¢A,..ƒXZ..±´Á.bi
  61604F0:  82 1D C4 D2 C1 3B 88 A5 - 47 77 10 4B 8E EE 20 96  ‚.ÄÒÁ;.¥Gw.KŽî –
  6160500:  D9 DD 41 2C B2 BB 83 58 - 64 77 07 B1 0D EE 0E 62  ÙÝA,²»ƒXdw.±.î.b
  6160510:  1A DC 1D C4 F1 B8 3B 88 - 27 71 77 10 4E E2 EE 20  .Ü.Äñ¸;.'qw.Nâî
  6160520:  9C C4 DD 41 38 89 BB 83 - B5 12 77 07 6A 25 EE 0E  œÄÝA8‰»ƒµ.w.j%î.
  6160530:  D4 4A DC 1D A8 95 B8 3B - 50 2B 71 77 A0 56 E2 EE  ÔJÜ.¨•¸;P+qw Vâî
  6160540:  85 AD C4 DD CF 5B 89 BB - 5B B7 12 77 B6 6E 25 EE  ….ÄÝÏ[‰»[·.w¶n%î
  6160550:  A9 DD 4A DC 97 BB 95 B8 - EB 77 2B 71 D6 EF 56 E2  ©ÝJÜ—»•¸ëw+qÖïVâ
  6160560:  69 DF AD C4 17 BE 5B 89 - EB 7C B7 12 D6 F9 6E 25  iß.Ä.¾[‰ë|·.Öùn%
  6160570:  AC F3 DD 4A 58 E7 BB 95 - 75 CE 77 2B EA 9C EF 56  ¬óÝJX绕uÎw+êœïV
  6160580:  D4 39 DF AD 6D 73 BE 5B - DA E6 7C B7 71 CD F9 6E  Ô9ß.ms¾[Úæ|·qÍùn
  6160590:  E2 9A F3 DD 01 35 E7 BB - C7 6A CE 77 8E D5 9C EF  âšóÝ.5ç»ÇjÎwŽÕœï
  61605A0:  D9 AB 39 DF 77 57 73 BE - 2B AE E6 7C 56 5C CD F9  Ù«9ßwWs¾+®æ|V\Íù
  61605B0:  69 B8 9A F3 17 70 35 E7 - EB E0 6A CE 13 C1 D5 9C  i¸šó.p5çëàjÎ.ÁÕœ
  61605C0:  E3 82 AB 39 C6 05 57 73 - 8C 0B AE E6 DD 17 5C CD  ã‚«9Æ.WsŒ.®æÝ.\Í
  61605D0:  7F 2F B8 9A 3B 5E 70 35 - 76 BC E0 6A EC 78 C1 D5  ./¸š;^p5v¼àjìxÁÕ
  61605E0:  1D F1 82 AB FF E2 05 57 - FE C5 0B AE 39 8B 17 5C  .ñ‚«ÿâ.WþÅ.®9‹.\
  61605F0:  72 16 2F B8 21 2C 5E 70 - 42 58 BC E0 41 B0 78 C1  r./¸!,^pBX¼àA°xÁ

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group
Top
 Profile  
 
HaQue
 Post subject: Re: Monolith - Repeating Hex Data
PostPosted: March 31st, 2016, 20:07 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3844
Location: Adelaide, Australia
at a quick glance, without looking at it closely... It may be what Sergey calls "each 3 pages is the same" which could mean it is a wl ver2 chip..

what is the nand ID, and monolith/pinout type?

It could also be the XOR key, maybe a virus but that's rare
Top
 Profile  
 
ddrecovery
 Post subject: Re: Monolith - Repeating Hex Data
PostPosted: March 31st, 2016, 20:14 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1710
Location: Phoenix, AZ USA
HaQue wrote:
at a quick glance, without looking at it closely... It may be what Sergey calls "each 3 pages is the same" which could mean it is a wl ver2 chip..

what is the nand ID, and monolith/pinout type?

It could also be the XOR key, maybe a virus but that's rare

Sorry I should have clarified. This is the Hex data before a pinout, just with a Hex reader of what is actually on the chip.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group
Top
 Profile  
 
HaQue
 Post subject: Re: Monolith - Repeating Hex Data
PostPosted: March 31st, 2016, 23:29 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3844
Location: Adelaide, Australia
ahh..
Quote:
Sorry I should have clarified. This is the Hex data before a pinout, just with a Hex reader of what is actually on the chip.

you mean opening the device in DMDE or winhex through its normal USB interface? Then probably not worth monolith recovery via nand pinout. I would do an image of the whole device and then scan it. Maybe look for IOC's on the systems it was used on (check your DR Rig as well!!!)

then have you tried scanning with r-studio or the like?

whats supposed to be on it? files, camera photo data, video, phone data?

Is there a FAT?

you may be looking at sector updates, where the controller caches sectors and consolidates the changes into one write when worthwhile.

could be encryption as well. hard to know without context.
Top
 Profile  
 
arvika
 Post subject: Re: Monolith - Repeating Hex Data
PostPosted: April 1st, 2016, 3:52 
Offline

Joined: October 24th, 2009, 15:22
Posts: 875
Location: Poland
It is worth read via pinout. It is very common when you have repeating sectors when controller is dead. Usually read directly from nand and assembly the image give good result.

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices
Top
 Profile  
 
ddrecovery
 Post subject: Re: Monolith - Repeating Hex Data
PostPosted: April 1st, 2016, 12:46 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1710
Location: Phoenix, AZ USA
HaQue wrote:
ahh..
Quote:
Sorry I should have clarified. This is the Hex data before a pinout, just with a Hex reader of what is actually on the chip.

you mean opening the device in DMDE or winhex through its normal USB interface? Then probably not worth monolith recovery via nand pinout. I would do an image of the whole device and then scan it. Maybe look for IOC's on the systems it was used on (check your DR Rig as well!!!)

then have you tried scanning with r-studio or the like?
whats supposed to be on it? files, camera photo data, video, phone data?
Is there a FAT?
you may be looking at sector updates, where the controller caches sectors and consolidates the changes into one write when worthwhile.
could be encryption as well. hard to know without context.

I have scanned with R-Studio and UFS Pro with the same results. It was full of generic data i.e. pictures MSO files etc. No FAT or any folder structure at all.

arvika wrote:
It is worth read via pinout. It is very common when you have repeating sectors when controller is dead. Usually read directly from nand and assembly the image give good result.

Sounds good. Many thanks.

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group
Top
 Profile  
 
lcoughey
 Post subject: Re: Monolith - Repeating Hex Data
PostPosted: April 1st, 2016, 12:53 
Offline
User avatar

Joined: February 9th, 2009, 16:13
Posts: 2520
Location: Ontario, Canada
I've seen this a lot with both with monolithic and Lexar CF cards over the past year. Chip off / pinout recoveries are the only option.

_________________
Luke
Recovery Force Data Recovery
Top
 Profile  
 
ddrecovery
 Post subject: Re: Monolith - Repeating Hex Data
PostPosted: April 1st, 2016, 13:27 
Offline
User avatar

Joined: June 11th, 2013, 17:01
Posts: 1710
Location: Phoenix, AZ USA
lcoughey wrote:
I've seen this a lot with both with monolithic and Lexar CF cards over the past year. Chip off / pinout recoveries are the only option.

Thanks Luke. Hope all is well in Canada :-). I bet your enjoying our elections......

_________________
HDD, SSD, Flash and RAID Data Recovery
Founder of The Data Recovery Professionals Group
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  Page 1 of 1
  [ 8 posts ] 

Main » Forums home » Flash storage, SSD

All times are UTC - 5 hours [ DST ]

Who is online

Users browsing this forum: No registered users and 68 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Switch to mobile style
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group