Cloning Tool

[maximus]

I would like to point out that since the very first part of the memory card is not readable, it would be impossible for it to show any partitions. For that to happen, the clone must either have been initialized by Windows, or the clone was not zero filled. I would suggest cloning to an image file instead of another drive, and then use software recovery tools to scan the image file for raw files. If the file system was at the beginning, then the only option is raw file recovery.

[rogfanther]

@maximus, I will ask here because it is somehow related to this thread.

Would it be possible and maybe not too complex to add an options to hddsuperclone ( or hddsupertool ) to zero the full drive ?

[bunty]

Hi maximus
Yes I will try to image card instead of direct cloning. Even if some starting part will not get imaged ,at least raw recovery will work.
I am sure I have zero filled ssd before cloning. Lets see results of imaging.
I will report results.

[bunty]

@maximus, I will ask here because it is somehow related to this thread.

Would it be possible and maybe not too complex to add an options to hddsuperclone ( or hddsupertool ) to zero the full drive ?

Hi rogfanther
I think software is already having zero filling option though I have not used it.

[bunty]

Hi maximus

Unfortunately there is bad news. As you have suggested ,I tried to image disk instead of cloning . But process ended abruptly giving error.
I am fearful card may fail due to multiple imaging as it is already in bad condition.

Attachments

[maximus]

That is not a good sign for sure. But hddsuperclone can be resumed with project file. You might be able to remove and reinsert the memory card to get it recognized again, then resume the recovery. You should choose to disconnect and then connect again, and if there is an issue you may need to choose the source again. If you have closed hddsuperclone you can reload (open) the project file, but you must choose both source and destination again.

[maximus]

If the card does die, hopefully you still have clone on the 120GB SSD. You could still do a raw recovery on that. You could use the zero fill option in hddsuperclone to write zeros to all the unrecovered sectors, using the project file that you saved from the cloning process. But I would suspect that it was initialized in windows, which could have affected a small portion of original data. Plus the zero fill will not fill past the original size of 64GB, so if there is any residual data past that, it would remain on the clone.

[fzabkar]

I would like to point out that since the very first part of the memory card is not readable, it would be impossible for it to show any partitions. For that to happen, the clone must either have been initialized by Windows, or the clone was not zero filled.

The MBR code does not look like any Windows MBR that I have seen.

http://thestarman.pcministry.com/asm/mbr/index.html

In fact it appears that the MBR was created by GParted.

https://superuser.com/questions/941411/why-does-gparted-make-my-flash-disk-bootable-if-not-malware-then-what

https://www.raspberrypi.org/forums/viewtopic.php?f=8&t=5115

Maybe that will jog the OP's memory.

[maximus]

@maximus, I will ask here because it is somehow related to this thread.
Would it be possible and maybe not too complex to add an options to hddsuperclone ( or hddsupertool ) to zero the full drive ?

It could be something that I add in the future. But it is not high on the priority list since there are many other tools that can do this.

[maximus]

I know this is in the conventional hard drive section, but I have a question to ask of those more familiar with flash recovery. In this case I can see from a screen shot that when trying to read the bad area in the memory card, the failed reads were taking about 5 seconds. I know this could be caused by the following reasons:

1) The memory card was performing internal read attempts to get a good read just like a conventional hard drive.
2) The card reader was performing multiple read attempts to get a good read.
3) Linux was being annoyingly stupid and performing multiple read attempts trying to get a good read even though you don't want it to.

I would like to know if case #1 happens. Will a memory card make internal read attempts to the extent that a conventional hard drive will?

[fzabkar]

A HDD would have a rotational latency of ~10msec for each read attempt whereas a solid state device would not. Therefore ISTM that 5 seconds is a very long time.

[maximus]

A HDD would have a rotational latency of ~10msec for each read attempt whereas a solid state device would not. Therefore ISTM that 5 seconds is a very long time.

I would think that too, that a solid state device should be quick to return a read error. I am just asking to be sure.

[bunty]

Hi maximus & fzabkar

Sorry for mistake from my end .
Initially while cloning I have used Transcend USB 2.0 Card reader on USB 2.0 Port. But while imaging I have used Transcend USB 3.0 card reader on USB 3.0 port.
I think it has something to do with abrupt error.
I have now created a NTFS partition on SSD & created card Image in reverse. I have been successfully and only After 99.18% read errors stated apprearing.
So now we have captured card in most efficient manner. Attached is log file of the process ,which may give you some hint whether imaging was right.

Download File- https://drive.google.com/file/d/0B8JKI5 ... sp=sharing

[maximus]

The recovery looks the same as the previous recovery. There is something additional you can try, it should recover 127 more sectors.

Open the project file again in hddsuperclone.
Select the same source and destination.
In the tools menu, select "Reset Log".
In the clone settings, uncheck Phase1, Phase2, and Phase3.
In the clone settings, make sure Reverse is checked.
In the clone settings, change the Clustersize to a value of 1.
Connect and start.

You should see the finished value jump from 124010368 to about 124010495.

There is always the slight possibility of reading even more since this is reading one sector at a time instead of 128 sector blocks. You can let it run for a little bit (at least 10 minutes) and see if the finished count climbs any more. If it does not climb any more, then you can stop the recovery. If it does keep climbing, let it run for awhile and then post a copy of the project file again so the pattern can be examined.

[bunty]

%Hi Guys there is an unfortunate end to this case & sadly I will have to return card to customer as "unrecoverable"
also it is painful that I haven't understood what is technical reason for this failure.
As reported earlier I have been successful to image card to 99.18% , I tried all softwares in normal /raw mode but nothing was found on this 62GB image.
Out of frustration I gave card to ne of my friend for imaging and he managed to clone in in windows this time.
Unfortunately no known file system / Data was found.
Now since nothing is left to be tried , I am giving up.
Those who are curious to investigate , I can give remote access .
Thank you all contributors.

[fzabkar]

Could the data be encrypted?

[HaQue]

Why, in 4 pages of forum posts, was a model, make of card.. or even a photo not provided? Depending on the card, the lack of proper image means that chip off is only way. Just because the card somewhat works does not mean it is imageable. a cards firmware in some cases can be thought of as part of its hardware. meaning blocks of code are part of the running of the controller essential to properly reading/writing what is stored on the NAND.
Please before you return it, could you photo the card and put it up here for a bit more completeness to this thread?
It will add more context to people reading it in the future.
If you can convince customer, maybe try chip-off.

I am not just beating the chip-off drum, but know this is the next step after imaging fails.

[bunty]

Hi HaQue

I have attached snap of card , I have already given description of card in first post itself , besides in hddsuperclone snaps it is mentioned source as sandisk 64GB CF card and target 120 GB SAMSUNG EVO SSD
I disagree with you. Card may not have firmware issue as it can be imaged upto 99% , if some issue is there with MCU or any other code generally card shows less size and does not give access to sectors at all. Here we can check any sector in hex.
Only sectors where nand has defects cannot be read (first 600MB)

Attachments

[fzabkar]

I would retrieve the card's Identify Device information sector. Look for stuck data bits.

There is a table of Extended Error Codes on page 5-19 of the following manual:

SanDisk CompactFlash Memory Card OEM Product Manual:
http://pdfstream.manualsonline.com/2/23ba20e9-6aaf-4f79-a7d9-f78379489686.pdf

The above codes are accessed via the Request Sense (03h) ATA command.

The Execute Drive Diagnostic (90h) command (page 5-3) may or may not return some useful information.

Diagnostic_Codes.gif (9.69 KiB) Viewed 14002 times

There is also a Translate Sector (87h) command (page 5-23) which looks very interesting:

When this command is issued, the controller responds with a 512-byte buffer of information on the desired cylinder, head and sector with the actual Logical Address.

Table 5-33 represents the information in the buffer. This command is unique to SanDisk CompactFlash Memory cards.

CF_Translate_Sector_info.gif (8.77 KiB) Viewed 14003 times

[bunty]

hi fzabkar
You have gone too deep in this case , appreciate all the efforts. Thank you.
I think if we got error codes from card that will clear where exact issue is.
I think I will have to connect card to CF > ATA adapter & thenn through serial adapater get terminal.
This is hell lot of exercise .I am sure I will not be able to make it.
Is there any other way to issue these commands or to check card ?
Thank You. Have a cheerful weekend