Help! need to refer someone for SDcard in dominican republic

[jeremyb]

BTW, it is possible for a bit to be stuck when reading the bus but not when writing to it. That's because different gates are involved, and each gate is separately enabled.

How is it possible to have a stuck bit when reading from the NAND bus, forget about the obvious not being able to accept commands, the translator table stored in the controller would be impossible to decipher by the controller. It wouldn't be able to read its firmware or boot up.

I should be getting the package Friday, everything is speculation till then.

[fzabkar]

A stuck bit on a bus need not manifest itself in the same way when reading and writing. That's because two different gates are involved. The problem could be in the read gate.

Clearly the NAND must be OK. Either the data are correctable via ECC, or the sector is reported as uncorrectable. The problem is elsewhere, as I have suggested earlier.

Code:

              /Wrt Enable
                |
                |
               |o
   Write  >----| >O---.
               |/     |
                      |
Data bit #n           +----> Bus bit #n
                      |
                /|    |
     Read <---O< |----'
                o|
                |
                |
              /Rd Enable

[HaQue]

@JB : I don't know if you ever used the SD Card reader with the .dll in FE but I have used it a few times getting a good image. If nothing else, the output log may be interesting in the FE interface. I don't have the proper FE adapter but just wired it up.

[jeremyb]

It's a 16GB Transcend CF Card NOT A FREAKING SD CARD!!!

Seems like a standard data recovery job to me unless I'm getting trolled... I'll validate the data with the client and follow up

[jeremyb]

There is 10GB of good data and the rest is corrupt, if I had to "guess" its a firmware issue w/ the camera, the CF card itself appears to be fine to me.
ECC is green in the areas where corrupt headers are seen and the card is fully functional.

:-\

[jeremyb]

There is 10GB of good data and the rest is corrupt, if I had to "guess" its a firmware issue w/ the camera, the CF card itself appears to be fine to me.
ECC is green in the areas where corrupt headers are seen and the card is fully functional.

:-\

In case anyone wants to follow along at home they can download a sample of the headers below..

I don't "think" its recoverable, it looks like every a 16bit word where one of the bits is stuck off, not inverted.

eg: 0x00 is always 0x00 but 0x6F will be 0x6B

0000 0000
0000 0000
vs
0110 1111
0110 1011

Attachments

CF16GB.zip

(1.3 KiB) Downloaded 684 times

[HaspHL]

I just had a PM from a friend who is too shy to post on this forum......

He had a case where two data lines were shorted (D8 and D9) resulting in a very similar issue to this. I guess if it is every 6th bit which is flipped it would be possible to write a script to revert them.

@jeremyb check for shorted data lines

[jeremyb]

I just had a PM from a friend who is too shy to post on this forum......

He had a case where two data lines were shorted (D8 and D9) resulting in a very similar issue to this. I guess if it is every 6th bit which is flipped it would be possible to write a script to revert them.

@jeremyb check for shorted data lines

That statement makes no sense.. what shorted data lines.. ("use the force Luke")

1. The NAND chips are fine.. The ECC passes so the data in the chips are fine, I can reassemble the physical image and validate it against the logical image, there is no difference so it's not an interface, controller or NAND issue w/ the CF card. The data was written to the card corrupted, to me the issue is with the Camera.

2. Its not an inverted bit, its a stuck bit, the bit is shorted to ground, it is ALWAYS zero you can't write a script to fix that because there is no operation to decode it..

3. The camera has a years worth of photos on it, only the most recent photos are corrupt.

[Arch Stanton]

Can you post header good file start up last instance of FF DA + 20 more bytes.

[Arch Stanton]

This is hardly a sentence. I meant to ask: Can you post a header of a good file from start till last instance of FF DA + 20 more bytes.

[fzabkar]

What puzzles me is why the file system metadata are not corrupt. Are there any strange file names or date/time stamps?

[fzabkar]

If the file system is FAT, wouldn't CHKDSK (in readonly mode) expect to find cross-linked files or other corruption?

[jeremyb]

What puzzles me is why the file system metadata are not corrupt. Are there any strange file names or date/time stamps?

If the file system is FAT, wouldn't CHKDSK (in readonly mode) expect to find cross-linked files or other corruption?

There is nothing physically wrong with the CF card, file system, or 80% of the data on the card.
It's a deleted file recovery.. 20% of the deleted files have a stuck bit with a value of 0 every 16bit word at bit 2

eg:

Code:

org: 1111 1111 0110 1111
mod: 1111 1111 0110 1011

In my opinion the Cameras firmware wrote corrupt data to the card.. perhaps a MOVSW instruction from corrupt DRAM?
As the value is stuck at zero no mater what the original value the damage is irreversible, its not an inverted bit.

[Arch Stanton]

So, no go?

[jeremyb]

So, no go?

I don't see any way to move forward, so yes..

BTW, Carrie Miko, did they get back to you? It looks like the jpeg header is missing, not that the files are encrypted. The EOF marker is present on the jpegs.

[Arch Stanton]

Carrie, was that name of customer? They used so many different email addresses with different names. Quite difficult too communicate with. For one, even after several requests she never sent me a reference file because "she didn't have one".

But as you have recovered files she now should have right? Feel free to send me some corrupt / headerless + a few reference files (joep@disktuna.com). If she agrees to that.

[Arch Stanton]

This appears to be a CF card thing.

Since then I have seen a couple more, in all cases CF cards. In one of the cases the problem was bent male pin in card reader, problem went away using a different reader.

Now I have another one again.

Attachments