MultiDrive – free backup, clone & wipe disk utility from Atola Technology

Main » Forums home » Flash storage, SSD

All times are UTC - 5 hours [ DST ]



Post new topic Reply to topic  Page 3 of 3
  [ 52 posts ]  Go to page Previous  1, 2, 3
  Print view Previous topic | Next topic 
Author Message
hddguy
 Post subject: Re: XOR C5F6-128
PostPosted: December 14th, 2011, 12:10 
Offline

Joined: November 9th, 2006, 15:15
Posts: 2984
ReclaiMe wrote:
4GB flash, of which I assume you have a 4GB dump.
It has 4 MB data on it, and the rest I assume are zeros?
That should be trivial, because

[zeros] XOR [pattern] = [pattern].

if you run the same statsitical computation as described above, it will give you the [pattern] perfectly.

it would be more difficult if you have 4GB flash filled to the brim with data. Still, that gives us 4K times pattern length, so should not be a problem.

The problem actually becomes worse if the length of the pattern is not known in advance. Not knowing the pattern length is the most significant difficulty I see.


This is assuming you know that the media contains zeros. XOR pattern looks random, so does data. Unless you know that the original content is zeros and the length of XOR pattern then you will not decipher.

But I am happy to be proven wrong, in fact would make Flash Recovery a little more interesting for me :)
Top
 Profile  
 
ReclaiMe
 Post subject: Re: XOR C5F6-128
PostPosted: December 14th, 2011, 12:30 
Offline

Joined: December 14th, 2011, 8:24
Posts: 60
Location: Cyberspace
drc, try this?


Attachments:
pattern.zip [624 Bytes]
Downloaded 623 times
Top
 Profile  
 
drc
 Post subject: Re: XOR C5F6-128
PostPosted: December 14th, 2011, 13:03 
Offline

Joined: August 12th, 2008, 13:11
Posts: 3235
Location: USA
ReclaiMe wrote:
drc, try this?

Good :mrgreen:

I can't see any way around needing to know the length however, which is why the standard approach is to get a similar device and zerofill, then read the NAND manually

_________________
You don't have to backup all of your files, just the ones you want to keep.
Top
 Profile  
 
ReclaiMe
 Post subject: Re: XOR C5F6-128
PostPosted: December 14th, 2011, 13:06 
Offline

Joined: December 14th, 2011, 8:24
Posts: 60
Location: Cyberspace
I suppose we can figure the length out as well, just not in under fifteen minutes.
Top
 Profile  
 
drc
 Post subject: Re: XOR C5F6-128
PostPosted: December 14th, 2011, 13:06 
Offline

Joined: August 12th, 2008, 13:11
Posts: 3235
Location: USA
I guess it depends on how badly someone wants the data

_________________
You don't have to backup all of your files, just the ones you want to keep.
Top
 Profile  
 
ReclaiMe
 Post subject: Re: XOR C5F6-128
PostPosted: December 14th, 2011, 13:18 
Offline

Joined: December 14th, 2011, 8:24
Posts: 60
Location: Cyberspace
drc, is there any practical limit on the pattern length? so that we can assume "pattern length is no larger than X"? And also, can we assume the pattern length to be a power of two? Or just an even number?
Top
 Profile  
 
lcoughey
 Post subject: Re: XOR C5F6-128
PostPosted: December 14th, 2011, 13:31 
Offline
User avatar

Joined: February 9th, 2009, 16:13
Posts: 2577
Location: Ontario, Canada
Wow! You guys are making my head hurt. I'm curious to know how much you are charging for this project to make it worth all the effort.

_________________
Luke
Recovery Force Data Recovery
Top
 Profile  
 
drc
 Post subject: Re: XOR C5F6-128
PostPosted: December 14th, 2011, 13:45 
Offline

Joined: August 12th, 2008, 13:11
Posts: 3235
Location: USA
ReclaiMe wrote:
drc, is there any practical limit on the pattern length? so that we can assume "pattern length is no larger than X"? And also, can we assume the pattern length to be a power of two? Or just an even number?

Haven't worked on enough XORed flash to make a generalized statement like that. Most people wanting recovery from a flash drive expect to pay $25-50 and realize that their files weren't that important when they hear the actual price

_________________
You don't have to backup all of your files, just the ones you want to keep.
Top
 Profile  
 
ReclaiMe
 Post subject: Re: XOR C5F6-128
PostPosted: December 14th, 2011, 14:08 
Offline

Joined: December 14th, 2011, 8:24
Posts: 60
Location: Cyberspace
lcoughey,

Project? What project? :)
Top
 Profile  
 
ReclaiMe
 Post subject: Re: XOR C5F6-128
PostPosted: December 14th, 2011, 14:37 
Offline

Joined: December 14th, 2011, 8:24
Posts: 60
Location: Cyberspace
drc, care to provide one more sample?

Same size, but different data, and now you pick any pattern length between 8 and 512. Looks like I got the solution for the unknown pattern length, though I'm much less sure on this one. And there are some problems with it because it is damn slow.
Top
 Profile  
 
drc
 Post subject: Re: XOR C5F6-128
PostPosted: December 14th, 2011, 14:43 
Offline

Joined: August 12th, 2008, 13:11
Posts: 3235
Location: USA
Sure. Will be later today or tomorrow, got a lot on my plate right now

_________________
You don't have to backup all of your files, just the ones you want to keep.
Top
 Profile  
 
Vladus
 Post subject: Re: XOR C5F6-128
PostPosted: December 16th, 2011, 7:00 
Offline

Joined: April 11th, 2011, 5:02
Posts: 8
Location: RussianFederation
C5 F6 - first two bytes in XOR block in hex / XOR block starts with these values
128 - length of XOR block is 128 pages of chip in dec

_________________
Vladus
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  Page 3 of 3
  [ 52 posts ]  Go to page Previous  1, 2, 3

Main » Forums home » Flash storage, SSD

All times are UTC - 5 hours [ DST ]

Who is online

Users browsing this forum: No registered users and 16 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Switch to mobile style
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group