Switch to full style
CompactFlash, SD, MMC, USB flash storage. Anything that does not have moving parts inside.
Post a reply

Counterfeit / fake memory stick identification - IT1178E

November 8th, 2016, 15:15

Hi all,

I have what I suspect to be a counterfeit / fake memory stick in. I wondered if anyone else could confirm? Memory stick has failed, so chip removal was required. However, I still cannot get the NAND to ID to confirm the capacity. It's quite possible that the NAND has failed, but I'm currently waiting for Ace TS to login and take a look just in case I have missed something.

The owner reports it as a 8GB memory stick. She also provided a second matching working 8GB memory stick purchased at her university, with the matching university branding. Under the plastic casing they are quite different.

The likely fake has a rectangular processor. I have only ever seen these before on fake memory sticks (eBay purchases etc, with 512Gb capacity for £15 etc) . It has ITE numbering, but for a processor number that does not exist (at least on Soft Center and PC3000 library) - IT1178E.

Moreover, the marking on the NAND chip on the underside of the chip is:

F17T482UCGE1GM
0 PW1512156 602
Made in TAIWAN

I cannot find any specification on this chip, but I'm taking a bet that in this case the '1G' at the end is indicating in this case that it is a 1GB NAND.

DSCF2253.JPG

DSCF2251.JPG


Thanks for any comments,
J

Re: Counterfeit / fake memory stick identification - IT1178E

November 8th, 2016, 15:24

I meet 2 weeks ago IT1178D controller. Looks similar like your case. But I can read ID 98 3a a8 92 - my case is 16GB.
If you read this TSOP48 from photo - there is no chance to get good ID. Legs are shorted and pins are dirty. Need clean it, remove shorts, and than try.

Re: Counterfeit / fake memory stick identification - IT1178E

November 8th, 2016, 15:31

Hi Michal,

Picture was taken immediately after chip removal from the PCB. The chip has been extensively cleaned (3 times!) and no shorts between pins now. Still no ID :(

Was the job you had in an actual 16GB Nand but with faked higher capacity? Or labelled as a genuine 16GB device?

John

Re: Counterfeit / fake memory stick identification - IT1178E

November 8th, 2016, 15:46

My case have real size 16GB, looks not fake. But it is refurbished for sure. Inside dump is plenty of software bad columns, hard to remove.

Re: Counterfeit / fake memory stick identification - IT1178E

November 8th, 2016, 16:06

It's missing a pin too, by the look of it.

But probably a NC one :-)

Happy to try it in SC and VNR readers if you wanna send it down?

Re: Counterfeit / fake memory stick identification - IT1178E

November 8th, 2016, 16:38

Thanks for the responses so far. Correct - there is a pin missing. This was the case before the NAND removal and the owner had not tampered with the memory stick ahead of delivery. The combination of all the factors (processor shape / number, marking on Nand, and missing pin) all add to my suspicions on this job.

When first received and the Nand was still attached to the PCB it would give an ID in Windows Device Manager as "NAND USB2DISK USB Device". With the Nand removed and the memory stick plugged in it gives the same ID in Windows and symptoms of failure.

The data stored is time sensitive, so I will take one more look at it tomorrow morning and have a final clean of the pins, then might give you a call Sean.

John

Re: Counterfeit / fake memory stick identification - IT1178E

November 8th, 2016, 16:52

Also look at my database http://odzyskiwanie-danych.com.pl/monol ... abase.html

for NAND chips v4 and v8. I meet few times refurbished TSOP48 chip but completly other pinout than standard. It is easy to check if you measure some pads on PCB.

Re: Counterfeit / fake memory stick identification - IT1178E

November 8th, 2016, 17:50

Hold on...
I must admit it's very hard to work with NAND chips with broken CLE pin.
CLE stands for Command Latch Enable and it forces databus of memory to "listen" the commands.
You send a command "READ ID" and chip just ignores you.
I mean chip has no idea that you send a command in case when CLE is not connected.
From the picture I can assume with 90% probability this chip has a standard TSOP48 pinout, no playing around is required.
You just need to fix a pin and solder it to VNR Monolith adapter, there's a secret area at the center (just keep this between us, I'm sure most of users have no idea how to use it;)) where you can solder TSOP48 chips with broken pins.
It won't be too easy to fix the pin but possible, probably work for 30 min (or 10 min for guys like Arvika, Jeremy and others).

Image

Re: Counterfeit / fake memory stick identification - IT1178E

November 9th, 2016, 7:12

Hello Sasha,

Looks like you are correct, it is pin 16 which is missing, so CLE on standard layouts. I've lined it up on an adapter for viewing.

DSCF2257.JPG


Note that this particular adapter looks box fresh ;)

Truth be known is that the prospect of soldering on the additional pin in the centre of the chip is not one I relish. I've only ever done it on the outside pins (usually when there has been accidental physical damage to SD cards) and there is a bit more room to manoeuvre.

Ace TS have confirmed that model of processor referenced on this stick is not supported by PC3000 which has a dynamic XOR so RAW is not possible either. If I can get a dump then happy to share. My suspicion though is that once the dump is obtained then this is going to be a 1GB chip on a faked 8GB processor which will then bring some other significant challenges with it.

J

Re: Counterfeit / fake memory stick identification - IT1178E

November 9th, 2016, 7:23

OK, after some fiddling getting a connection to pin 16 I've got ID :)

Chip ID= 0xADDE14A7

Currently reading as a 8GB NAND with single part. I'm looking forward to seeing what is actually in this dump. Perhaps this is not a fake, but maybe as Michal's and this is refurbished.

J

Re: Counterfeit / fake memory stick identification - IT1178E

November 9th, 2016, 19:56

Sasha Sheremetov wrote:It won't be too easy to fix the pin but possible, probably work for 30 min (or 10 min for guys like Arvika, Jeremy and others).
It was easier to leave it attached to the PCB in my case ;-) :D :D :D :D
Attachments
damaged-pin.jpg
damaged-pin.jpg (48.86 KiB) Viewed 19957 times

Re: Counterfeit / fake memory stick identification - IT1178E

November 9th, 2016, 20:27

jeremyb wrote:
Sasha Sheremetov wrote:It won't be too easy to fix the pin but possible, probably work for 30 min (or 10 min for guys like Arvika, Jeremy and others).
It was easier to leave it attached to the PCB in my case ;-) :D :D :D :D

What do you use to cut through the chip surface?

Re: Counterfeit / fake memory stick identification - IT1178E

November 9th, 2016, 21:03

ddrecovery wrote:
jeremyb wrote:
Sasha Sheremetov wrote:It won't be too easy to fix the pin but possible, probably work for 30 min (or 10 min for guys like Arvika, Jeremy and others).
It was easier to leave it attached to the PCB in my case ;-) :D :D :D :D

What do you use to cut through the chip surface?
I thought you were IPC certified :D :D :D
How I cut through the surface does not matter, only that the surface no longer exists... Besides, that's an awesome solder job, put some black overcoat on it and that shit looks factory, ready for sale in Shenzhen.

Re: Counterfeit / fake memory stick identification - IT1178E

November 9th, 2016, 22:06

That's okay. We all have our secrets.

Re: Counterfeit / fake memory stick identification - IT1178E

November 9th, 2016, 22:16

ddrecovery wrote:That's okay. We all have our secrets.
:beer: :agree: :good: :good: :good:

Re: Counterfeit / fake memory stick identification - IT1178E

November 10th, 2016, 9:46

On this one there was still some metal contact left on the NAND and I was able to bridge the broken pin and the contact on the chip reader to get a connection without re-soldering. Sean is taking a look at the dump at the moment, I can't detect the type of XOR used.

J

Re: Counterfeit / fake memory stick identification - IT1178E

November 16th, 2016, 16:55

Sean took a look a the dump on this one for an extra opinion, again no XOR or ECC found. Had to be declared a non-recovery as it had time sensitive data on.

Re: Counterfeit / fake memory stick identification - IT1178E

November 16th, 2016, 17:11

If you want - I can check too.

Re: Counterfeit / fake memory stick identification - IT1178E

February 15th, 2018, 5:52

A follow up of sorts to this:

I have just received in another memory stick using the IT1178E processor. It came from the same vending machine at the same university, external plastic case the same was the same as that for the memory stick in the original post.

The NAND used has a different ID. Specifications:
IT1178E PKGJ9.1
$45DE9493
Marked on rear of NAND: DNCG16021603035 / 6887396357

Again, I can find no traces of known XOR or ECC. If anyone want to take a look then PM me, I can upload the dump.

John

Re: Counterfeit / fake memory stick identification - IT1178E

February 15th, 2018, 7:52

did you try reading this one as DDR?
Post a reply