All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 7 posts ] 
Author Message
 Post subject: 16 GB monolith showing 2 TB capacity
PostPosted: June 14th, 2019, 11:07 
Offline

Joined: July 7th, 2014, 6:44
Posts: 160
Location: Switzerland
We received a "no name" monolith USB flash drive, which according to the customer is a 16 GB one.
Below are several pictures.

In the BIOS, it appears as three different storages.
For this flash drive, "fdisk -l" lists three 4 GB volumes for that drive : sdb, sde and sdg
as well a sdc which has an absurd capacity of 275 GB.

All /dev/sdX "partitions" can be cloned without problem and hex analysis shows non-null content in them.
However, analyzed individually, there show no files.

/dev/sda is not listed but appears as 2 TB when cloned.

In Windows, both the disk management and diskpart show the flash drive as a 2 TB disk without any partition.

Opening the flash drive in Windows with the hexadecimal editor HxD, this one shows the first sectors as unreadable with a grey background.
Additionnally, there is an "Incorrect function" popup.

HxD also sees the flash drive with the erroneous capacity of 2 TB (4278190080 sectors).

From within HxD, it is possible to access the sectors near the impossible location of 2 TB.
The last sectors show identical content, which doesn't seem random.
Maybe is this the XOR key applied to blank sectors?

"Rewinding" the sector offset to explore content up to the first sectors shows non-null content in all the 2 TB space.
Sectors 0, 1, ... show something, contrarily to just after opening the drive.
In HxD, the "Incorrect function" popups shows appear, but sectors are still accessed.

Because of the three 4GB storages, I wonder if this corrupted USB flash drive behaves like a RAID storage and/or if the 4GB storages are the content of the crystal / planes.
Maybe is a fourth 4GB chunk at /dev/sdf (which is not listed) or simply at /dev/sdc which obvioulsy has wrong size.

Before considering the use of advanced tools like VNR Rusolut, PC3000-Flash or Soft-Center is there something more to try?


Attachments:
File comment: As viewed by fdisk -l in Linux.
fdisk-l.jpg
fdisk-l.jpg [ 97.4 KiB | Viewed 1229 times ]
File comment: First sectors of the flash drive viewed in HxD.
hex_screenshot1.jpg
hex_screenshot1.jpg [ 239.28 KiB | Viewed 1229 times ]
File comment: View of the flash drive from the BIOS.
defective-16-gb-flash-drive-in-BIOS.jpg
defective-16-gb-flash-drive-in-BIOS.jpg [ 55.32 KiB | Viewed 1229 times ]
File comment: Last sectors of the 2TB storage as viewed by HxD.
last-sectors-of-2TB.jpg
last-sectors-of-2TB.jpg [ 162.51 KiB | Viewed 1229 times ]
File comment: Initial view of the 16 GB flash drive in HxD.
usb-16gb-in-HxD-screenshot1.jpg
usb-16gb-in-HxD-screenshot1.jpg [ 45.54 KiB | Viewed 1229 times ]
File comment: With DISKPART in Windows Terminal.
usb-flash-drive-as-Disque-1-in-Diskpart.jpg
usb-flash-drive-as-Disque-1-in-Diskpart.jpg [ 29.37 KiB | Viewed 1229 times ]
File comment: In Windows Disk Management.
usb-16-gb-flash-drive-shows-as-2-tb.jpg
usb-16-gb-flash-drive-shows-as-2-tb.jpg [ 10.35 KiB | Viewed 1229 times ]
Top
 Profile  
 
 Post subject: Re: 16 GB monolith showing 2 TB capacity
PostPosted: June 16th, 2019, 6:19 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3411
Location: Adelaide, Australia
have you tried scanning with partition find and mount, or imaging the whole disk (not partitions) with DMDE and scanning with r-studio?

if the controller goes haywire, you wont get sense from it in win or *nix


Top
 Profile  
 
 Post subject: Re: 16 GB monolith showing 2 TB capacity
PostPosted: June 16th, 2019, 13:01 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2544
Location: Kuwait
@SOSdonnees , this is typical Controller (not stable) issue there is NO WAY to read it, and if you squeeze it more with reading it will not mount
you have to do it the hard way (if your client is willing to pay)

@HaQue , dump it & scan it will not do any good, you will not find anything useful/working

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein


Top
 Profile  
 
 Post subject: Re: 16 GB monolith showing 2 TB capacity
PostPosted: June 16th, 2019, 20:21 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3411
Location: Adelaide, Australia
einstein9 wrote:
@SOSdonnees , this is typical Controller (not stable) issue there is NO WAY to read it, and if you squeeze it more with reading it will not mount
you have to do it the hard way (if your client is willing to pay)

@HaQue , dump it & scan it will not do any good, you will not find anything useful/working


I agree, thats why I asked. If this fails it usually means bad pcb/component/circuitry. Not sure with the info given how the controller can be identified yet. It will likely be a SM,PS,AU or one of the other less common, but common on crappy Drives, UT,SK,IT or SanDisk.

@SOSdonnees do you have a picture of it?


Top
 Profile  
 
 Post subject: Re: 16 GB monolith showing 2 TB capacity
PostPosted: June 17th, 2019, 3:54 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2544
Location: Kuwait
HaQue wrote:
einstein9 wrote:
@SOSdonnees , this is typical Controller (not stable) issue there is NO WAY to read it, and if you squeeze it more with reading it will not mount
you have to do it the hard way (if your client is willing to pay)

@HaQue , dump it & scan it will not do any good, you will not find anything useful/working


I agree, thats why I asked. If this fails it usually means bad pcb/component/circuitry. Not sure with the info given how the controller can be identified yet. It will likely be a SM,PS,AU or one of the other less common, but common on crappy Drives, UT,SK,IT or SanDisk.

@SOSdonnees do you have a picture of it?


this is a monolith case, 95% of my clients run away when they get the estimated/init. cost :lol: :lol:

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein


Top
 Profile  
 
 Post subject: Re: 16 GB monolith showing 2 TB capacity
PostPosted: June 17th, 2019, 10:24 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3411
Location: Adelaide, Australia
Once the monolith is wired and dumped, the dump is the same as any other flash job, so why the huge cost?


Top
 Profile  
 
 Post subject: Re: 16 GB monolith showing 2 TB capacity
PostPosted: June 17th, 2019, 11:54 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2544
Location: Kuwait
HaQue wrote:
Once the monolith is wired and dumped, the dump is the same as any other flash job, so why the huge cost?


Our Init. cost for such a Monolith case 300$ and +++++

regular flash are much cheaper (depends if we are free to do it or busy with HDDs)..

:wink:

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 7 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 14 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group