All times are UTC - 5 hours [ DST ]


Switch to mobile style


Post new topic Reply to topic  [ 9 posts ] 
Author Message
 Post subject: Can someone identify this first sector in a flash drive ?
PostPosted: August 2nd, 2014, 8:33 
Offline

Joined: November 15th, 2012, 17:47
Posts: 228
Attachment:
hex.txt
I was examning a Flash drives MBR to check if there is any Byte-interleave. The dump from the Flash drive has already gone through some processes such as XOR extraction and others, but I can not yet see a normal Fat32 MBR yet. Can someone help. Attached is the dump after the processes.


Top
 Profile  
 
 Post subject: Re: Can someone identify this first sector in a flash drive
PostPosted: August 2nd, 2014, 9:05 
Offline

Joined: July 2nd, 2014, 8:05
Posts: 201
There's no file attached to topic.

_________________
VISUAL NAND RECONSTRUCTOR. A big revolution in chip-off data recovery


Top
 Profile  
 
 Post subject: Re: Can someone identify this first sector in a flash drive
PostPosted: August 2nd, 2014, 10:57 
Offline

Joined: November 15th, 2012, 17:47
Posts: 228
Sorry, here is the bin file>

http://www.filedropper.com/hex


Top
 Profile  
 
 Post subject: Re: Can someone identify this first sector in a flash drive
PostPosted: August 2nd, 2014, 13:41 
Offline
User avatar

Joined: December 4th, 2012, 1:35
Posts: 3779
Location: Adelaide, Australia
looks like part of the flash firmware, or a cd partition on the flash drive.
IMHO it should start with BtPramCD so yes, maybe some interleave or something not done right. see comparison with my example which is a code file example that flashes leds on a flash drive when uploaded to one.
Attachment:
a.jpg
a.jpg [ 254.68 KiB | Viewed 8370 times ]


Top
 Profile  
 
 Post subject: Re: Can someone identify this first sector in a flash drive
PostPosted: August 2nd, 2014, 14:19 
Offline

Joined: July 2nd, 2014, 8:05
Posts: 201
Bit errors..Apply ECC. There's no byte split in PS2251(looks like Phison). You either overheated chip or standard 3.3V produces too much noise. Attach one block with data here I check it in bitmap

_________________
VISUAL NAND RECONSTRUCTOR. A big revolution in chip-off data recovery


Top
 Profile  
 
 Post subject: Re: Can someone identify this first sector in a flash drive
PostPosted: August 2nd, 2014, 15:47 
Offline

Joined: July 2nd, 2014, 8:05
Posts: 201
This is bit error from HaQue's comparison

Image

_________________
VISUAL NAND RECONSTRUCTOR. A big revolution in chip-off data recovery


Top
 Profile  
 
 Post subject: Re: Can someone identify this first sector in a flash drive
PostPosted: August 3rd, 2014, 12:52 
Offline

Joined: November 15th, 2012, 17:47
Posts: 228
Does ECC function well in a transformed page ? Will not some of the ECC information get lost during the process ?


Sasha Sheremetov wrote:
This is bit error from HaQue's comparison

Image


Top
 Profile  
 
 Post subject: Re: Can someone identify this first sector in a flash drive
PostPosted: August 3rd, 2014, 16:07 
Offline

Joined: July 2nd, 2014, 8:05
Posts: 201
You need to apply ECC on physical images (dumps). If chip has bad columns then remove them and apply ECC on the result. (Most latest TLC chips of Sandisk [0x45] and Toshiba [0x98] have them.)

_________________
VISUAL NAND RECONSTRUCTOR. A big revolution in chip-off data recovery


Top
 Profile  
 
 Post subject: Re: Can someone identify this first sector in a flash drive
PostPosted: August 4th, 2014, 11:22 
Offline

Joined: November 15th, 2012, 17:47
Posts: 228
Thank you everyone for your help. I have succeeded in recovering all the data. The problem was that the auto method failed to identify the correct Translator, I got the right info from Solbase. It have to admit that I was a little lazy to ask for help without first looking there.

Thanks


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 9 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 10 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group