All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 20 posts ] 
Author Message
 Post subject: Need help
PostPosted: March 18th, 2023, 11:05 
Offline

Joined: March 18th, 2023, 11:03
Posts: 10
Location: South East Asia
Hello all, hope you're doing well, would really appreciate your help. I have an SD card on my android phone that corrupted(images became black and won't load). I quickly took it out from my phone and backed it up with ddrescue, I now have a .dd file. After examining the sd card through test disk and r-studio no partitions show up. I've also tried to scan the .dd file and also no partitions show up. I do not know what else to try at this point. Hope you could point me to the right course of action to take.
Many thanks.


Top
 Profile  
 
 Post subject: Re: Need help
PostPosted: March 18th, 2023, 14:31 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
Is the card encrypted?

Can you show us the contents of the first sector with a hex editor such as HxD (freeware)?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Need help
PostPosted: March 18th, 2023, 17:54 
Offline

Joined: March 18th, 2023, 11:03
Posts: 10
Location: South East Asia
fzabkar wrote:
Is the card encrypted?

Can you show us the contents of the first sector with a hex editor such as HxD (freeware)?


Hello, I'm not really sure if the card was encrypted. Okay I will do it right now.


Top
 Profile  
 
 Post subject: Re: Need help
PostPosted: March 18th, 2023, 18:09 
Offline

Joined: March 18th, 2023, 11:03
Posts: 10
Location: South East Asia
Attachment:
File comment: Output of HxD, for both the actual card and the backup image
sector.png
sector.png [ 114.66 KiB | Viewed 3770 times ]

Hello here's the output of HxD both from the actual card and the .dd image.


Top
 Profile  
 
 Post subject: Re: Need help
PostPosted: March 18th, 2023, 18:13 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
That's what you would expect if the card had been erased. If you drag the vertical scrollbar from top to bottom, do you see anything that looks like data?

If you select Analysis -> Statistics, do you see anything other than a large spike at the RHS (FFh)?

If you compress the dd image with 7Zip, what size is the compressed image?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Need help
PostPosted: March 18th, 2023, 18:50 
Offline

Joined: March 18th, 2023, 11:03
Posts: 10
Location: South East Asia
Hello again sorry for the late reply.
1. Nope, all I see is FF FF FF and so on...
2. It's still analyzing. Will follow up on the result.
3. I compressed the dd image with 7zip to sbd.7z format and the compressed size is just 4,618 kb.


Top
 Profile  
 
 Post subject: Re: Need help
PostPosted: March 18th, 2023, 19:27 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
Your card appears to have been totally erased, or is in a state where there is no data access.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Need help
PostPosted: March 18th, 2023, 19:36 
Offline

Joined: March 18th, 2023, 11:03
Posts: 10
Location: South East Asia
Thank you so much for your help. I guess I'm just out of luck and will just have to live with the loss of my data :(


Top
 Profile  
 
 Post subject: Re: Need help
PostPosted: March 18th, 2023, 20:24 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
Try another card reader just to be sure.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Need help
PostPosted: March 18th, 2023, 20:26 
Offline

Joined: March 18th, 2023, 11:03
Posts: 10
Location: South East Asia
fzabkar wrote:
Try another card reader just to be sure.

I've tried it on two different laptops, doesn't read it at all. No partition shows up.


Top
 Profile  
 
 Post subject: Re: Need help
PostPosted: March 18th, 2023, 20:55 
Offline

Joined: March 18th, 2023, 11:03
Posts: 10
Location: South East Asia
caano wrote:
Hello again sorry for the late reply.
1. Nope, all I see is FF FF FF and so on...
2. It's still analyzing. Will follow up on the result.
3. I compressed the dd image with 7zip to sbd.7z format and the compressed size is just 4,618 kb.

Just finished analysis, nothing shows up there at all, just a plain blank white screen.


Top
 Profile  
 
 Post subject: Re: Need help
PostPosted: March 19th, 2023, 3:21 
Offline

Joined: October 24th, 2009, 15:22
Posts: 872
Location: Poland
There is still chip-off method recovery which can give good result even if now you see only FF.

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices


Top
 Profile  
 
 Post subject: Re: Need help
PostPosted: March 19th, 2023, 6:58 
Offline

Joined: March 18th, 2023, 11:03
Posts: 10
Location: South East Asia
Is that something I could do or would I need a professional to do that? If it's the latter how much do those kinds of services cost? I'm not that rich at all :(


Top
 Profile  
 
 Post subject: Re: Need help
PostPosted: March 19th, 2023, 9:44 
Offline

Joined: March 18th, 2023, 11:03
Posts: 10
Location: South East Asia
arvika wrote:
There is still chip-off method recovery which can give good result even if now you see only FF.

Is this something I could do or would I need a professional for this? Also if it's the latter how much do there types of services usually cost?
Thanks a lot.


Top
 Profile  
 
 Post subject: Re: Need help
PostPosted: March 19th, 2023, 13:59 
Offline

Joined: October 24th, 2009, 15:22
Posts: 872
Location: Poland
For such job you need data recovery company (not all can do this). Cost depends on capacity, controler type, monolith or standard construction etc.

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices


Top
 Profile  
 
 Post subject: Re: Need help
PostPosted: March 19th, 2023, 14:33 
Offline

Joined: November 7th, 2020, 5:31
Posts: 1084
Location: The_UK
@arvika - Somewhat surprised to see you post that considering the situation. It's a microsd out of the phone. It's going to be monolithic, potentially ldpc and highly likely to encrypted. I would have thought problems with the translator/controller would be the least of the concerns. Chip off in this case appears to be somewhat of a very long shot.

_________________
Data Recovery Services in the UK.
https://www.usbrecovery.co.uk/


Top
 Profile  
 
 Post subject: Re: Need help
PostPosted: March 19th, 2023, 16:12 
Offline

Joined: October 24th, 2009, 15:22
Posts: 872
Location: Poland
Lardman, I miss info that it is from phone. So it is monolith for sure. But why you assume that it is LDPC? We do not know what is the model. I meet many cards looks erased, filled by FF, but chip-off give very good result. One model of PNY card have such problem quite often.

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices


Top
 Profile  
 
 Post subject: Re: Need help
PostPosted: March 19th, 2023, 16:30 
Offline

Joined: November 7th, 2020, 5:31
Posts: 1084
Location: The_UK
Just based on what gets dumped on my desk - all be it nowhere near the volumes you see. It wasn't just the lpdc I was referring to as encryption but also that of the android phone itself. Feels rather a long shot for useable data to be recovered.

_________________
Data Recovery Services in the UK.
https://www.usbrecovery.co.uk/


Top
 Profile  
 
 Post subject: Re: Need help
PostPosted: March 19th, 2023, 16:43 
Offline

Joined: October 24th, 2009, 15:22
Posts: 872
Location: Poland
Many scenrio is possible. Thats why it is worth make an expertise. Than client decide what to do ;)

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices


Top
 Profile  
 
 Post subject: Re: Need help
PostPosted: March 19th, 2023, 17:49 
Offline

Joined: March 18th, 2023, 11:03
Posts: 10
Location: South East Asia
Thank you for all your replies, I've just decided to live with the fact that I've lost years worth of data.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 20 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: melvin and 18 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group