All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 21 posts ]  Go to page 1, 2  Next
Author Message
 Post subject: Counterfeit / fake memory stick identification - IT1178E
PostPosted: November 8th, 2016, 15:15 
Offline

Joined: February 18th, 2009, 8:08
Posts: 243
Location: Manchester, UK
Hi all,

I have what I suspect to be a counterfeit / fake memory stick in. I wondered if anyone else could confirm? Memory stick has failed, so chip removal was required. However, I still cannot get the NAND to ID to confirm the capacity. It's quite possible that the NAND has failed, but I'm currently waiting for Ace TS to login and take a look just in case I have missed something.

The owner reports it as a 8GB memory stick. She also provided a second matching working 8GB memory stick purchased at her university, with the matching university branding. Under the plastic casing they are quite different.

The likely fake has a rectangular processor. I have only ever seen these before on fake memory sticks (eBay purchases etc, with 512Gb capacity for £15 etc) . It has ITE numbering, but for a processor number that does not exist (at least on Soft Center and PC3000 library) - IT1178E.

Moreover, the marking on the NAND chip on the underside of the chip is:

F17T482UCGE1GM
0 PW1512156 602
Made in TAIWAN

I cannot find any specification on this chip, but I'm taking a bet that in this case the '1G' at the end is indicating in this case that it is a 1GB NAND.

Attachment:
DSCF2253.JPG
DSCF2253.JPG [ 444.05 KiB | Viewed 7478 times ]

Attachment:
DSCF2251.JPG
DSCF2251.JPG [ 188.13 KiB | Viewed 7478 times ]


Thanks for any comments,
J

_________________
CDR - Manchester Data Recovery Services
0161 408 4857
http://www.cheadledatarecovery.co.uk/


Top
 Profile  
 
 Post subject: Re: Counterfeit / fake memory stick identification - IT1178E
PostPosted: November 8th, 2016, 15:24 
Offline

Joined: October 24th, 2009, 15:22
Posts: 579
Location: Poland
I meet 2 weeks ago IT1178D controller. Looks similar like your case. But I can read ID 98 3a a8 92 - my case is 16GB.
If you read this TSOP48 from photo - there is no chance to get good ID. Legs are shorted and pins are dirty. Need clean it, remove shorts, and than try.

_________________
Odzyskiwanie danych


Top
 Profile  
 
 Post subject: Re: Counterfeit / fake memory stick identification - IT1178E
PostPosted: November 8th, 2016, 15:31 
Offline

Joined: February 18th, 2009, 8:08
Posts: 243
Location: Manchester, UK
Hi Michal,

Picture was taken immediately after chip removal from the PCB. The chip has been extensively cleaned (3 times!) and no shorts between pins now. Still no ID :(

Was the job you had in an actual 16GB Nand but with faked higher capacity? Or labelled as a genuine 16GB device?

John

_________________
CDR - Manchester Data Recovery Services
0161 408 4857
http://www.cheadledatarecovery.co.uk/


Top
 Profile  
 
 Post subject: Re: Counterfeit / fake memory stick identification - IT1178E
PostPosted: November 8th, 2016, 15:46 
Offline

Joined: October 24th, 2009, 15:22
Posts: 579
Location: Poland
My case have real size 16GB, looks not fake. But it is refurbished for sure. Inside dump is plenty of software bad columns, hard to remove.

_________________
Odzyskiwanie danych


Top
 Profile  
 
 Post subject: Re: Counterfeit / fake memory stick identification - IT1178E
PostPosted: November 8th, 2016, 16:06 
Offline

Joined: November 29th, 2006, 10:08
Posts: 7171
Location: UK
It's missing a pin too, by the look of it.

But probably a NC one :-)

Happy to try it in SC and VNR readers if you wanna send it down?

_________________
PC Image Data Recovery
www.pcimage.co.uk


Top
 Profile  
 
 Post subject: Re: Counterfeit / fake memory stick identification - IT1178E
PostPosted: November 8th, 2016, 16:38 
Offline

Joined: February 18th, 2009, 8:08
Posts: 243
Location: Manchester, UK
Thanks for the responses so far. Correct - there is a pin missing. This was the case before the NAND removal and the owner had not tampered with the memory stick ahead of delivery. The combination of all the factors (processor shape / number, marking on Nand, and missing pin) all add to my suspicions on this job.

When first received and the Nand was still attached to the PCB it would give an ID in Windows Device Manager as "NAND USB2DISK USB Device". With the Nand removed and the memory stick plugged in it gives the same ID in Windows and symptoms of failure.

The data stored is time sensitive, so I will take one more look at it tomorrow morning and have a final clean of the pins, then might give you a call Sean.

John

_________________
CDR - Manchester Data Recovery Services
0161 408 4857
http://www.cheadledatarecovery.co.uk/


Top
 Profile  
 
 Post subject: Re: Counterfeit / fake memory stick identification - IT1178E
PostPosted: November 8th, 2016, 16:52 
Offline

Joined: October 24th, 2009, 15:22
Posts: 579
Location: Poland
Also look at my database http://odzyskiwanie-danych.com.pl/monol ... abase.html

for NAND chips v4 and v8. I meet few times refurbished TSOP48 chip but completly other pinout than standard. It is easy to check if you measure some pads on PCB.

_________________
Odzyskiwanie danych


Top
 Profile  
 
 Post subject: Re: Counterfeit / fake memory stick identification - IT1178E
PostPosted: November 8th, 2016, 17:50 
Offline

Joined: July 2nd, 2014, 8:05
Posts: 168
Hold on...
I must admit it's very hard to work with NAND chips with broken CLE pin.
CLE stands for Command Latch Enable and it forces databus of memory to "listen" the commands.
You send a command "READ ID" and chip just ignores you.
I mean chip has no idea that you send a command in case when CLE is not connected.
From the picture I can assume with 90% probability this chip has a standard TSOP48 pinout, no playing around is required.
You just need to fix a pin and solder it to VNR Monolith adapter, there's a secret area at the center (just keep this between us, I'm sure most of users have no idea how to use it;)) where you can solder TSOP48 chips with broken pins.
It won't be too easy to fix the pin but possible, probably work for 30 min (or 10 min for guys like Arvika, Jeremy and others).

Image

_________________
VISUAL NAND RECONSTRUCTOR. A big revolution in chip-off data recovery


Top
 Profile  
 
 Post subject: Re: Counterfeit / fake memory stick identification - IT1178E
PostPosted: November 9th, 2016, 7:12 
Offline

Joined: February 18th, 2009, 8:08
Posts: 243
Location: Manchester, UK
Hello Sasha,

Looks like you are correct, it is pin 16 which is missing, so CLE on standard layouts. I've lined it up on an adapter for viewing.

Attachment:
DSCF2257.JPG
DSCF2257.JPG [ 484.75 KiB | Viewed 7384 times ]


Note that this particular adapter looks box fresh ;)

Truth be known is that the prospect of soldering on the additional pin in the centre of the chip is not one I relish. I've only ever done it on the outside pins (usually when there has been accidental physical damage to SD cards) and there is a bit more room to manoeuvre.

Ace TS have confirmed that model of processor referenced on this stick is not supported by PC3000 which has a dynamic XOR so RAW is not possible either. If I can get a dump then happy to share. My suspicion though is that once the dump is obtained then this is going to be a 1GB chip on a faked 8GB processor which will then bring some other significant challenges with it.

J

_________________
CDR - Manchester Data Recovery Services
0161 408 4857
http://www.cheadledatarecovery.co.uk/


Top
 Profile  
 
 Post subject: Re: Counterfeit / fake memory stick identification - IT1178E
PostPosted: November 9th, 2016, 7:23 
Offline

Joined: February 18th, 2009, 8:08
Posts: 243
Location: Manchester, UK
OK, after some fiddling getting a connection to pin 16 I've got ID :)

Chip ID= 0xADDE14A7

Currently reading as a 8GB NAND with single part. I'm looking forward to seeing what is actually in this dump. Perhaps this is not a fake, but maybe as Michal's and this is refurbished.

J

_________________
CDR - Manchester Data Recovery Services
0161 408 4857
http://www.cheadledatarecovery.co.uk/


Top
 Profile  
 
 Post subject: Re: Counterfeit / fake memory stick identification - IT1178E
PostPosted: November 9th, 2016, 19:56 
Offline

Joined: July 30th, 2012, 3:37
Posts: 236
Location: Fairfield, CT USA
Sasha Sheremetov wrote:
It won't be too easy to fix the pin but possible, probably work for 30 min (or 10 min for guys like Arvika, Jeremy and others).
It was easier to leave it attached to the PCB in my case ;-) :D :D :D :D


Attachments:
damaged-pin.jpg
damaged-pin.jpg [ 48.86 KiB | Viewed 7332 times ]

_________________
Recover My Flash Drive
Top
 Profile  
 
 Post subject: Re: Counterfeit / fake memory stick identification - IT1178E
PostPosted: November 9th, 2016, 20:27 
Offline

Joined: June 11th, 2013, 17:01
Posts: 993
Location: USA
jeremyb wrote:
Sasha Sheremetov wrote:
It won't be too easy to fix the pin but possible, probably work for 30 min (or 10 min for guys like Arvika, Jeremy and others).
It was easier to leave it attached to the PCB in my case ;-) :D :D :D :D

What do you use to cut through the chip surface?

_________________
Hard Drive and RAID Data Recovery


Top
 Profile  
 
 Post subject: Re: Counterfeit / fake memory stick identification - IT1178E
PostPosted: November 9th, 2016, 21:03 
Offline

Joined: July 30th, 2012, 3:37
Posts: 236
Location: Fairfield, CT USA
ddrecovery wrote:
jeremyb wrote:
Sasha Sheremetov wrote:
It won't be too easy to fix the pin but possible, probably work for 30 min (or 10 min for guys like Arvika, Jeremy and others).
It was easier to leave it attached to the PCB in my case ;-) :D :D :D :D

What do you use to cut through the chip surface?
I thought you were IPC certified :D :D :D
How I cut through the surface does not matter, only that the surface no longer exists... Besides, that's an awesome solder job, put some black overcoat on it and that shit looks factory, ready for sale in Shenzhen.

_________________
Recover My Flash Drive


Top
 Profile  
 
 Post subject: Re: Counterfeit / fake memory stick identification - IT1178E
PostPosted: November 9th, 2016, 22:06 
Offline

Joined: June 11th, 2013, 17:01
Posts: 993
Location: USA
That's okay. We all have our secrets.

_________________
Hard Drive and RAID Data Recovery


Top
 Profile  
 
 Post subject: Re: Counterfeit / fake memory stick identification - IT1178E
PostPosted: November 9th, 2016, 22:16 
Offline

Joined: July 30th, 2012, 3:37
Posts: 236
Location: Fairfield, CT USA
ddrecovery wrote:
That's okay. We all have our secrets.
:beer: :agree: :good: :good: :good:

_________________
Recover My Flash Drive


Top
 Profile  
 
 Post subject: Re: Counterfeit / fake memory stick identification - IT1178E
PostPosted: November 10th, 2016, 9:46 
Offline

Joined: February 18th, 2009, 8:08
Posts: 243
Location: Manchester, UK
On this one there was still some metal contact left on the NAND and I was able to bridge the broken pin and the contact on the chip reader to get a connection without re-soldering. Sean is taking a look at the dump at the moment, I can't detect the type of XOR used.

J

_________________
CDR - Manchester Data Recovery Services
0161 408 4857
http://www.cheadledatarecovery.co.uk/


Top
 Profile  
 
 Post subject: Re: Counterfeit / fake memory stick identification - IT1178E
PostPosted: November 16th, 2016, 16:55 
Offline

Joined: February 18th, 2009, 8:08
Posts: 243
Location: Manchester, UK
Sean took a look a the dump on this one for an extra opinion, again no XOR or ECC found. Had to be declared a non-recovery as it had time sensitive data on.


Top
 Profile  
 
 Post subject: Re: Counterfeit / fake memory stick identification - IT1178E
PostPosted: November 16th, 2016, 17:11 
Offline

Joined: October 24th, 2009, 15:22
Posts: 579
Location: Poland
If you want - I can check too.

_________________
Odzyskiwanie danych


Top
 Profile  
 
 Post subject: Re: Counterfeit / fake memory stick identification - IT1178E
PostPosted: February 15th, 2018, 5:52 
Offline

Joined: February 18th, 2009, 8:08
Posts: 243
Location: Manchester, UK
A follow up of sorts to this:

I have just received in another memory stick using the IT1178E processor. It came from the same vending machine at the same university, external plastic case the same was the same as that for the memory stick in the original post.

The NAND used has a different ID. Specifications:
IT1178E PKGJ9.1
$45DE9493
Marked on rear of NAND: DNCG16021603035 / 6887396357

Again, I can find no traces of known XOR or ECC. If anyone want to take a look then PM me, I can upload the dump.

John

_________________
CDR - Manchester Data Recovery Services
0161 408 4857
http://www.cheadledatarecovery.co.uk/


Top
 Profile  
 
 Post subject: Re: Counterfeit / fake memory stick identification - IT1178E
PostPosted: February 15th, 2018, 7:52 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3152
Location: Adelaide, Australia
did you try reading this one as DDR?


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 21 posts ]  Go to page 1, 2  Next

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 5 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group