HDD GURU FORUMS
http://forum.hddguru.com/

16 GB monolith showing 2 TB capacity
http://forum.hddguru.com/viewtopic.php?f=10&t=38505		 Page 1 of 1
Author:  SOSdonnees [ June 14th, 2019, 11:07 ]
Post subject:  16 GB monolith showing 2 TB capacity
We received a "no name" monolith USB flash drive, which according to the customer is a 16 GB one.
Below are several pictures.

In the BIOS, it appears as three different storages.
For this flash drive, "fdisk -l" lists three 4 GB volumes for that drive : sdb, sde and sdg
as well a sdc which has an absurd capacity of 275 GB.

All /dev/sdX "partitions" can be cloned without problem and hex analysis shows non-null content in them.
However, analyzed individually, there show no files.

/dev/sda is not listed but appears as 2 TB when cloned.

In Windows, both the disk management and diskpart show the flash drive as a 2 TB disk without any partition.

Opening the flash drive in Windows with the hexadecimal editor HxD, this one shows the first sectors as unreadable with a grey background.
Additionnally, there is an "Incorrect function" popup.

HxD also sees the flash drive with the erroneous capacity of 2 TB (4278190080 sectors).

From within HxD, it is possible to access the sectors near the impossible location of 2 TB.
The last sectors show identical content, which doesn't seem random.
Maybe is this the XOR key applied to blank sectors?

"Rewinding" the sector offset to explore content up to the first sectors shows non-null content in all the 2 TB space.
Sectors 0, 1, ... show something, contrarily to just after opening the drive.
In HxD, the "Incorrect function" popups shows appear, but sectors are still accessed.

Because of the three 4GB storages, I wonder if this corrupted USB flash drive behaves like a RAID storage and/or if the 4GB storages are the content of the crystal / planes.
Maybe is a fourth 4GB chunk at /dev/sdf (which is not listed) or simply at /dev/sdc which obvioulsy has wrong size.

Before considering the use of advanced tools like VNR Rusolut, PC3000-Flash or Soft-Center is there something more to try?

Attachments:
File comment: As viewed by fdisk -l in Linux.
fdisk-l.jpg
fdisk-l.jpg [ 97.4 KiB | Viewed 6263 times ]
File comment: First sectors of the flash drive viewed in HxD.
hex_screenshot1.jpg
hex_screenshot1.jpg [ 239.28 KiB | Viewed 6263 times ]
File comment: View of the flash drive from the BIOS.
defective-16-gb-flash-drive-in-BIOS.jpg
defective-16-gb-flash-drive-in-BIOS.jpg [ 55.32 KiB | Viewed 6263 times ]
File comment: Last sectors of the 2TB storage as viewed by HxD.
last-sectors-of-2TB.jpg
last-sectors-of-2TB.jpg [ 162.51 KiB | Viewed 6263 times ]
File comment: Initial view of the 16 GB flash drive in HxD.
usb-16gb-in-HxD-screenshot1.jpg
usb-16gb-in-HxD-screenshot1.jpg [ 45.54 KiB | Viewed 6263 times ]
File comment: With DISKPART in Windows Terminal.
usb-flash-drive-as-Disque-1-in-Diskpart.jpg
usb-flash-drive-as-Disque-1-in-Diskpart.jpg [ 29.37 KiB | Viewed 6263 times ]
File comment: In Windows Disk Management.
usb-16-gb-flash-drive-shows-as-2-tb.jpg
usb-16-gb-flash-drive-shows-as-2-tb.jpg [ 10.35 KiB | Viewed 6263 times ]
Author:  HaQue [ June 16th, 2019, 6:19 ]
Post subject:  Re: 16 GB monolith showing 2 TB capacity
have you tried scanning with partition find and mount, or imaging the whole disk (not partitions) with DMDE and scanning with r-studio?

if the controller goes haywire, you wont get sense from it in win or *nix
Author:  einstein9 [ June 16th, 2019, 13:01 ]
Post subject:  Re: 16 GB monolith showing 2 TB capacity
@SOSdonnees , this is typical Controller (not stable) issue there is NO WAY to read it, and if you squeeze it more with reading it will not mount
you have to do it the hard way (if your client is willing to pay)

@HaQue , dump it & scan it will not do any good, you will not find anything useful/working
Author:  HaQue [ June 16th, 2019, 20:21 ]
Post subject:  Re: 16 GB monolith showing 2 TB capacity
einstein9 wrote:
@SOSdonnees , this is typical Controller (not stable) issue there is NO WAY to read it, and if you squeeze it more with reading it will not mount
you have to do it the hard way (if your client is willing to pay)

@HaQue , dump it & scan it will not do any good, you will not find anything useful/working


I agree, thats why I asked. If this fails it usually means bad pcb/component/circuitry. Not sure with the info given how the controller can be identified yet. It will likely be a SM,PS,AU or one of the other less common, but common on crappy Drives, UT,SK,IT or SanDisk.

@SOSdonnees do you have a picture of it?
Author:  einstein9 [ June 17th, 2019, 3:54 ]
Post subject:  Re: 16 GB monolith showing 2 TB capacity
HaQue wrote:
einstein9 wrote:
@SOSdonnees , this is typical Controller (not stable) issue there is NO WAY to read it, and if you squeeze it more with reading it will not mount
you have to do it the hard way (if your client is willing to pay)

@HaQue , dump it & scan it will not do any good, you will not find anything useful/working


I agree, thats why I asked. If this fails it usually means bad pcb/component/circuitry. Not sure with the info given how the controller can be identified yet. It will likely be a SM,PS,AU or one of the other less common, but common on crappy Drives, UT,SK,IT or SanDisk.

@SOSdonnees do you have a picture of it?


this is a monolith case, 95% of my clients run away when they get the estimated/init. cost :lol: :lol:
Author:  HaQue [ June 17th, 2019, 10:24 ]
Post subject:  Re: 16 GB monolith showing 2 TB capacity
Once the monolith is wired and dumped, the dump is the same as any other flash job, so why the huge cost?
Author:  einstein9 [ June 17th, 2019, 11:54 ]
Post subject:  Re: 16 GB monolith showing 2 TB capacity
HaQue wrote:
Once the monolith is wired and dumped, the dump is the same as any other flash job, so why the huge cost?


Our Init. cost for such a Monolith case 300$ and +++++

regular flash are much cheaper (depends if we are free to do it or busy with HDDs)..

:wink:
Page 1 of 1 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/