May 23rd, 2024, 13:05
May 23rd, 2024, 13:54
May 23rd, 2024, 14:46
fzabkar wrote:Rstudio and Rundelete are safe (pros use R-Studio).
I would first clone the drive to an image file on your HDD using the Tools -> Copy Sectors feature of DMDE. Then you can run data recovery software against the clone.
Software used by DR pros:
https://www.hddoracle.com/viewtopic.php?f=36&t=3208
May 23rd, 2024, 15:49
May 25th, 2024, 9:17
May 25th, 2024, 10:31
May 26th, 2024, 1:36
May 26th, 2024, 4:34
fzabkar wrote:Can you upload one of the smaller files (ZIP-ed) so that we can see what the corruption looks like?
May 26th, 2024, 12:11
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000370B0 68 30 24 06 08 2B 40 01 05 05 87 30 01 86 18 68 h0$..+@...‡0.†.h
000370C0 74 74 70 3A 0F 2F 6F 63 73 70 2E 64 69 67 69 63 ttp:./ocsp.digic
2F /
000370D0 64 72 74 2E 6B 6F 6D 30 41 06 28 2B 06 01 85 05 drt.kom0A.(+..….
65 63 e c
000370E0 86 30 02 86 15 68 74 74 F0 3A 2F 2F 23 61 63 65 †0.†.httð://#ace
70 p
000370F0 72 74 71 2E 6C 69 47 69 63 65 70 74 2D 63 3F 6D rtq.liGicept-c?m
64 67 72 d g r
00037100 2F 44 79 67 69 43 65 72 54 54 70 75 F3 74 65 64 /DygiCerTTpuóted
69 72 73 i r s
00037110 52 6F 6E 74 43 34 6E 63 72 74 30 43 84 03 54 1D RontC4ncrt0C„.T.
00037120 1F 04 34 30 3B 30 78 A0 76 A0 34 86 B2 68 78 74 ..40;0x v 4†²hxt
00037130 30 3A 47 2F 6B 72 6C 33 1A 64 61 67 69 63 65 72 0:G/krl3.dagicer
69 i
00037140 74 2E 62 6F 6D 2F 44 69 67 69 43 65 7A 74 54 72 t.bom/DigiCeztTr
63 72 c r
00037150 75 73 54 65 64 52 6D 6F D5 47 34 2E E3 72 6C 30 usTedRmoÕG4.ãrl0
May 26th, 2024, 12:14
fzabkar wrote:You can see that bits have flipped in random directions. Sometimes a 1 becomes a 0, and sometimes a 0 becomes a 1. Therefore your cloned image isn't of much use. I confess I don't understand why these sectors haven't generated read errors.
ISTM that your only DIY option would be to disassemble the USB stick and cool the NAND chip with freeze spray while cloning.PFconcept\avg_antivirus_free_setup.exe
- Code:
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000370B0 68 30 24 06 08 2B 40 01 05 05 87 30 01 86 18 68 h0$..+@...‡0.†.h
000370C0 74 74 70 3A 0F 2F 6F 63 73 70 2E 64 69 67 69 63 ttp:./ocsp.digic
2F /
000370D0 64 72 74 2E 6B 6F 6D 30 41 06 28 2B 06 01 85 05 drt.kom0A.(+..….
65 63 e c
000370E0 86 30 02 86 15 68 74 74 F0 3A 2F 2F 23 61 63 65 †0.†.httð://#ace
70 p
000370F0 72 74 71 2E 6C 69 47 69 63 65 70 74 2D 63 3F 6D rtq.liGicept-c?m
64 67 72 d g r
00037100 2F 44 79 67 69 43 65 72 54 54 70 75 F3 74 65 64 /DygiCerTTpuóted
69 72 73 i r s
00037110 52 6F 6E 74 43 34 6E 63 72 74 30 43 84 03 54 1D RontC4ncrt0C„.T.
00037120 1F 04 34 30 3B 30 78 A0 76 A0 34 86 B2 68 78 74 ..40;0x v 4†²hxt
00037130 30 3A 47 2F 6B 72 6C 33 1A 64 61 67 69 63 65 72 0:G/krl3.dagicer
69 i
00037140 74 2E 62 6F 6D 2F 44 69 67 69 43 65 7A 74 54 72 t.bom/DigiCeztTr
63 72 c r
00037150 75 73 54 65 64 52 6D 6F D5 47 34 2E E3 72 6C 30 usTedRmoÕG4.ãrl0
May 26th, 2024, 12:36
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000370B0 69 30 24 06 08 2B 06 01 05 05 07 30 01 86 18 68 i0$..+.....0.†.h
000370C0 74 74 70 3A 2F 2F 6F 63 73 70 2E 64 69 67 69 63 ttp://ocsp.digic
000370D0 65 72 74 2E 63 6F 6D 30 41 06 08 2B 06 01 05 05 ert.com0A..+....
000370E0 07 30 02 86 35 68 74 74 70 3A 2F 2F 63 61 63 65 .0.†5http://cace
000370F0 72 74 73 2E 64 69 67 69 63 65 72 74 2E 63 6F 6D rts.digicert.com
00037100 2F 44 69 67 69 43 65 72 74 54 72 75 73 74 65 64 /DigiCertTrusted
00037110 52 6F 6F 74 47 34 2E 63 72 74 30 43 06 03 55 1D RootG4.crt0C..U.
00037120 1F 04 3C 30 3A 30 38 A0 36 A0 34 86 32 68 74 74 ..<0:08 6 4†2htt
00037130 70 3A 2F 2F 63 72 6C 33 2E 64 69 67 69 63 65 72 p://crl3.digicer
00037140 74 2E 63 6F 6D 2F 44 69 67 69 43 65 72 74 54 72 t.com/DigiCertTr
00037150 75 73 74 65 64 52 6F 6F 74 47 34 2E 63 72 6C 30 ustedRootG4.crl0
May 26th, 2024, 12:40
kotel wrote:Can I cool it down with a compressor? I only have that at hand and no compressed air in a can.
May 27th, 2024, 4:46
May 27th, 2024, 5:20
May 27th, 2024, 6:16
Exactly the same corruption or just the same pattern ?kotel wrote:Tried creating an image of the drive while cooling it down with compressor. Same corruption.
May 27th, 2024, 14:23
Lardman wrote:Exactly the same corruption or just the same pattern ?kotel wrote:Tried creating an image of the drive while cooling it down with compressor. Same corruption.
fzabkar wrote:You don't need datasheets. The NAND will be surrounded by small filter capacitors. Just measure the voltages on these capacitors.
May 27th, 2024, 15:02
May 28th, 2024, 5:55
May 29th, 2024, 9:43
May 29th, 2024, 10:44
Powered by phpBB © phpBB Group.