HDD GURU FORUMS
http://forum.hddguru.com/

Monolith - Repeating Hex Data
http://forum.hddguru.com/viewtopic.php?f=10&t=33191		 Page 1 of 1
Author:  ddrecovery [ March 31st, 2016, 19:50 ]
Post subject:  Monolith - Repeating Hex Data
Anyone seen this on a Monolith?

The drive has a repeating pattern of FF's for several thousand sectors, then a repeating pattern of data (sector based). Then goes back to FF for a few thousand sectors before a different repeating pattern starts. Interestingly the data pattern starts at sector 1024. Is this worth a pin-out (probably not), I presume its maybe a virus? Flash drive does give the correct volume.
Code:
Sector 199423

  615FE00:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FE10:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FE20:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FE30:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FE40:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FE50:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FE60:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FE70:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FE80:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FE90:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FEA0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FEB0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FEC0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FED0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FEE0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FEF0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FF00:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FF10:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FF20:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FF30:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FF40:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FF50:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FF60:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FF70:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FF80:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FF90:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FFA0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FFB0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FFC0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FFD0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FFE0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ
  615FFF0:  FF FF FF FF FF FF FF FF - FF FF FF FF FF FF FF FF  ÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿÿ

Sector 199424

  6160000:  EB 36 08 82 13 6D 10 04 - 26 DA 20 08 4C B4 41 10  ë6.‚.m..&Ú .L´A.
  6160010:  98 68 83 20 30 D1 06 41 - 60 A2 0D 82 05 44 1B 04  .hƒ 0Ñ.A`¢.‚.D..
  6160020:  0A 88 36 08 14 10 6D 10 - 28 20 DA 20 50 40 B4 41  ..6...m.( Ú P@´A
  6160030:  A0 80 68 83 85 01 D1 06 - 0A 03 A2 0D 14 06 44 1B   .hƒ….Ñ...¢...D.
  6160040:  28 0C 88 36 50 18 10 6D - A0 30 20 DA 85 61 40 B4  (..6P..m 0 Ú…a@´
  6160050:  CF C3 80 68 9E 87 01 D1 - F9 0F 03 A2 37 1F 06 44  ÏÃ.hž‡.Ñù..¢7..D
  6160060:  6E 3E 0C 88 19 7C 18 10 - 32 F8 30 20 64 F0 61 40  n>...|..2ø0 dða@
  6160070:  C8 E0 C3 80 55 C1 87 01 - AA 82 0F 03 54 05 1F 06  ÈàÃ.UÁ‡.ª‚..T...
  6160080:  A8 0A 3E 0C 50 15 7C 18 - A0 2A F8 30 40 55 F0 61  ¨.>.P.|. *ø0@Uða
  6160090:  80 AA E0 C3 C5 55 C1 87 - 4F AB 82 0F 9E 56 05 1F  .ªàÃÅUÁ‡O«‚.žV..
  61600A0:  3C AD 0A 3E 78 5A 15 7C - F0 B4 2A F8 25 69 55 F0  <..>xZ.|ð´*ø%iUð
  61600B0:  8F D2 AA E0 DB A5 55 C1 - 73 4B AB 82 23 96 56 05  .ÒªàÛ¥UÁsK«‚#–V.
  61600C0:  46 2C AD 0A 8C 58 5A 15 - 18 B1 B4 2A 30 62 69 55  F,..ŒXZ..±´*0biU
  61600D0:  60 C4 D2 AA 05 88 A5 55 - 0A 10 4B AB D1 20 96 56  `ÄÒª..¥U..K«Ñ –V
  61600E0:  A2 41 2C AD 81 83 58 5A - 02 07 B1 B4 C1 0E 62 69  ¢A,..ƒXZ..±´Á.bi
  61600F0:  82 1D C4 D2 C1 3B 88 A5 - 47 77 10 4B 8E EE 20 96  ‚.ÄÒÁ;.¥Gw.KŽî –
  6160100:  D9 DD 41 2C B2 BB 83 58 - 64 77 07 B1 0D EE 0E 62  ÙÝA,²»ƒXdw.±.î.b
  6160110:  1A DC 1D C4 F1 B8 3B 88 - 27 71 77 10 4E E2 EE 20  .Ü.Äñ¸;.'qw.Nâî
  6160120:  9C C4 DD 41 38 89 BB 83 - B5 12 77 07 6A 25 EE 0E  œÄÝA8‰»ƒµ.w.j%î.
  6160130:  D4 4A DC 1D A8 95 B8 3B - 50 2B 71 77 A0 56 E2 EE  ÔJÜ.¨•¸;P+qw Vâî
  6160140:  85 AD C4 DD CF 5B 89 BB - 5B B7 12 77 B6 6E 25 EE  ….ÄÝÏ[‰»[·.w¶n%î
  6160150:  A9 DD 4A DC 97 BB 95 B8 - EB 77 2B 71 D6 EF 56 E2  ©ÝJÜ—»•¸ëw+qÖïVâ
  6160160:  69 DF AD C4 17 BE 5B 89 - EB 7C B7 12 D6 F9 6E 25  iß.Ä.¾[‰ë|·.Öùn%
  6160170:  AC F3 DD 4A 58 E7 BB 95 - 75 CE 77 2B EA 9C EF 56  ¬óÝJX绕uÎw+êœïV
  6160180:  D4 39 DF AD 6D 73 BE 5B - DA E6 7C B7 71 CD F9 6E  Ô9ß.ms¾[Úæ|·qÍùn
  6160190:  E2 9A F3 DD 01 35 E7 BB - C7 6A CE 77 8E D5 9C EF  âšóÝ.5ç»ÇjÎwŽÕœï
  61601A0:  D9 AB 39 DF 77 57 73 BE - 2B AE E6 7C 56 5C CD F9  Ù«9ßwWs¾+®æ|V\Íù
  61601B0:  69 B8 9A F3 17 70 35 E7 - EB E0 6A CE 13 C1 D5 9C  i¸šó.p5çëàjÎ.ÁÕœ
  61601C0:  E3 82 AB 39 C6 05 57 73 - 8C 0B AE E6 DD 17 5C CD  ã‚«9Æ.WsŒ.®æÝ.\Í
  61601D0:  7F 2F B8 9A 3B 5E 70 35 - 76 BC E0 6A EC 78 C1 D5  ./¸š;^p5v¼àjìxÁÕ
  61601E0:  1D F1 82 AB FF E2 05 57 - FE C5 0B AE 39 8B 17 5C  .ñ‚«ÿâ.WþÅ.®9‹.\
  61601F0:  72 16 2F B8 21 2C 5E 70 - 42 58 BC E0 41 B0 78 C1  r./¸!,^pBX¼àA°xÁ

Sector 199425

  6160200:  EB 36 08 82 13 6D 10 04 - 26 DA 20 08 4C B4 41 10  ë6.‚.m..&Ú .L´A.
  6160210:  98 68 83 20 30 D1 06 41 - 60 A2 0D 82 05 44 1B 04  .hƒ 0Ñ.A`¢.‚.D..
  6160220:  0A 88 36 08 14 10 6D 10 - 28 20 DA 20 50 40 B4 41  ..6...m.( Ú P@´A
  6160230:  A0 80 68 83 85 01 D1 06 - 0A 03 A2 0D 14 06 44 1B   .hƒ….Ñ...¢...D.
  6160240:  28 0C 88 36 50 18 10 6D - A0 30 20 DA 85 61 40 B4  (..6P..m 0 Ú…a@´
  6160250:  CF C3 80 68 9E 87 01 D1 - F9 0F 03 A2 37 1F 06 44  ÏÃ.hž‡.Ñù..¢7..D
  6160260:  6E 3E 0C 88 19 7C 18 10 - 32 F8 30 20 64 F0 61 40  n>...|..2ø0 dða@
  6160270:  C8 E0 C3 80 55 C1 87 01 - AA 82 0F 03 54 05 1F 06  ÈàÃ.UÁ‡.ª‚..T...
  6160280:  A8 0A 3E 0C 50 15 7C 18 - A0 2A F8 30 40 55 F0 61  ¨.>.P.|. *ø0@Uða
  6160290:  80 AA E0 C3 C5 55 C1 87 - 4F AB 82 0F 9E 56 05 1F  .ªàÃÅUÁ‡O«‚.žV..
  61602A0:  3C AD 0A 3E 78 5A 15 7C - F0 B4 2A F8 25 69 55 F0  <..>xZ.|ð´*ø%iUð
  61602B0:  8F D2 AA E0 DB A5 55 C1 - 73 4B AB 82 23 96 56 05  .ÒªàÛ¥UÁsK«‚#–V.
  61602C0:  46 2C AD 0A 8C 58 5A 15 - 18 B1 B4 2A 30 62 69 55  F,..ŒXZ..±´*0biU
  61602D0:  60 C4 D2 AA 05 88 A5 55 - 0A 10 4B AB D1 20 96 56  `ÄÒª..¥U..K«Ñ –V
  61602E0:  A2 41 2C AD 81 83 58 5A - 02 07 B1 B4 C1 0E 62 69  ¢A,..ƒXZ..±´Á.bi
  61602F0:  82 1D C4 D2 C1 3B 88 A5 - 47 77 10 4B 8E EE 20 96  ‚.ÄÒÁ;.¥Gw.KŽî –
  6160300:  D9 DD 41 2C B2 BB 83 58 - 64 77 07 B1 0D EE 0E 62  ÙÝA,²»ƒXdw.±.î.b
  6160310:  1A DC 1D C4 F1 B8 3B 88 - 27 71 77 10 4E E2 EE 20  .Ü.Äñ¸;.'qw.Nâî
  6160320:  9C C4 DD 41 38 89 BB 83 - B5 12 77 07 6A 25 EE 0E  œÄÝA8‰»ƒµ.w.j%î.
  6160330:  D4 4A DC 1D A8 95 B8 3B - 50 2B 71 77 A0 56 E2 EE  ÔJÜ.¨•¸;P+qw Vâî
  6160340:  85 AD C4 DD CF 5B 89 BB - 5B B7 12 77 B6 6E 25 EE  ….ÄÝÏ[‰»[·.w¶n%î
  6160350:  A9 DD 4A DC 97 BB 95 B8 - EB 77 2B 71 D6 EF 56 E2  ©ÝJÜ—»•¸ëw+qÖïVâ
  6160360:  69 DF AD C4 17 BE 5B 89 - EB 7C B7 12 D6 F9 6E 25  iß.Ä.¾[‰ë|·.Öùn%
  6160370:  AC F3 DD 4A 58 E7 BB 95 - 75 CE 77 2B EA 9C EF 56  ¬óÝJX绕uÎw+êœïV
  6160380:  D4 39 DF AD 6D 73 BE 5B - DA E6 7C B7 71 CD F9 6E  Ô9ß.ms¾[Úæ|·qÍùn
  6160390:  E2 9A F3 DD 01 35 E7 BB - C7 6A CE 77 8E D5 9C EF  âšóÝ.5ç»ÇjÎwŽÕœï
  61603A0:  D9 AB 39 DF 77 57 73 BE - 2B AE E6 7C 56 5C CD F9  Ù«9ßwWs¾+®æ|V\Íù
  61603B0:  69 B8 9A F3 17 70 35 E7 - EB E0 6A CE 13 C1 D5 9C  i¸šó.p5çëàjÎ.ÁÕœ
  61603C0:  E3 82 AB 39 C6 05 57 73 - 8C 0B AE E6 DD 17 5C CD  ã‚«9Æ.WsŒ.®æÝ.\Í
  61603D0:  7F 2F B8 9A 3B 5E 70 35 - 76 BC E0 6A EC 78 C1 D5  ./¸š;^p5v¼àjìxÁÕ
  61603E0:  1D F1 82 AB FF E2 05 57 - FE C5 0B AE 39 8B 17 5C  .ñ‚«ÿâ.WþÅ.®9‹.\
  61603F0:  72 16 2F B8 21 2C 5E 70 - 42 58 BC E0 41 B0 78 C1  r./¸!,^pBX¼àA°xÁ

Sector 199426

  6160400:  EB 36 08 82 13 6D 10 04 - 26 DA 20 08 4C B4 41 10  ë6.‚.m..&Ú .L´A.
  6160410:  98 68 83 20 30 D1 06 41 - 60 A2 0D 82 05 44 1B 04  .hƒ 0Ñ.A`¢.‚.D..
  6160420:  0A 88 36 08 14 10 6D 10 - 28 20 DA 20 50 40 B4 41  ..6...m.( Ú P@´A
  6160430:  A0 80 68 83 85 01 D1 06 - 0A 03 A2 0D 14 06 44 1B   .hƒ….Ñ...¢...D.
  6160440:  28 0C 88 36 50 18 10 6D - A0 30 20 DA 85 61 40 B4  (..6P..m 0 Ú…a@´
  6160450:  CF C3 80 68 9E 87 01 D1 - F9 0F 03 A2 37 1F 06 44  ÏÃ.hž‡.Ñù..¢7..D
  6160460:  6E 3E 0C 88 19 7C 18 10 - 32 F8 30 20 64 F0 61 40  n>...|..2ø0 dða@
  6160470:  C8 E0 C3 80 55 C1 87 01 - AA 82 0F 03 54 05 1F 06  ÈàÃ.UÁ‡.ª‚..T...
  6160480:  A8 0A 3E 0C 50 15 7C 18 - A0 2A F8 30 40 55 F0 61  ¨.>.P.|. *ø0@Uða
  6160490:  80 AA E0 C3 C5 55 C1 87 - 4F AB 82 0F 9E 56 05 1F  .ªàÃÅUÁ‡O«‚.žV..
  61604A0:  3C AD 0A 3E 78 5A 15 7C - F0 B4 2A F8 25 69 55 F0  <..>xZ.|ð´*ø%iUð
  61604B0:  8F D2 AA E0 DB A5 55 C1 - 73 4B AB 82 23 96 56 05  .ÒªàÛ¥UÁsK«‚#–V.
  61604C0:  46 2C AD 0A 8C 58 5A 15 - 18 B1 B4 2A 30 62 69 55  F,..ŒXZ..±´*0biU
  61604D0:  60 C4 D2 AA 05 88 A5 55 - 0A 10 4B AB D1 20 96 56  `ÄÒª..¥U..K«Ñ –V
  61604E0:  A2 41 2C AD 81 83 58 5A - 02 07 B1 B4 C1 0E 62 69  ¢A,..ƒXZ..±´Á.bi
  61604F0:  82 1D C4 D2 C1 3B 88 A5 - 47 77 10 4B 8E EE 20 96  ‚.ÄÒÁ;.¥Gw.KŽî –
  6160500:  D9 DD 41 2C B2 BB 83 58 - 64 77 07 B1 0D EE 0E 62  ÙÝA,²»ƒXdw.±.î.b
  6160510:  1A DC 1D C4 F1 B8 3B 88 - 27 71 77 10 4E E2 EE 20  .Ü.Äñ¸;.'qw.Nâî
  6160520:  9C C4 DD 41 38 89 BB 83 - B5 12 77 07 6A 25 EE 0E  œÄÝA8‰»ƒµ.w.j%î.
  6160530:  D4 4A DC 1D A8 95 B8 3B - 50 2B 71 77 A0 56 E2 EE  ÔJÜ.¨•¸;P+qw Vâî
  6160540:  85 AD C4 DD CF 5B 89 BB - 5B B7 12 77 B6 6E 25 EE  ….ÄÝÏ[‰»[·.w¶n%î
  6160550:  A9 DD 4A DC 97 BB 95 B8 - EB 77 2B 71 D6 EF 56 E2  ©ÝJÜ—»•¸ëw+qÖïVâ
  6160560:  69 DF AD C4 17 BE 5B 89 - EB 7C B7 12 D6 F9 6E 25  iß.Ä.¾[‰ë|·.Öùn%
  6160570:  AC F3 DD 4A 58 E7 BB 95 - 75 CE 77 2B EA 9C EF 56  ¬óÝJX绕uÎw+êœïV
  6160580:  D4 39 DF AD 6D 73 BE 5B - DA E6 7C B7 71 CD F9 6E  Ô9ß.ms¾[Úæ|·qÍùn
  6160590:  E2 9A F3 DD 01 35 E7 BB - C7 6A CE 77 8E D5 9C EF  âšóÝ.5ç»ÇjÎwŽÕœï
  61605A0:  D9 AB 39 DF 77 57 73 BE - 2B AE E6 7C 56 5C CD F9  Ù«9ßwWs¾+®æ|V\Íù
  61605B0:  69 B8 9A F3 17 70 35 E7 - EB E0 6A CE 13 C1 D5 9C  i¸šó.p5çëàjÎ.ÁÕœ
  61605C0:  E3 82 AB 39 C6 05 57 73 - 8C 0B AE E6 DD 17 5C CD  ã‚«9Æ.WsŒ.®æÝ.\Í
  61605D0:  7F 2F B8 9A 3B 5E 70 35 - 76 BC E0 6A EC 78 C1 D5  ./¸š;^p5v¼àjìxÁÕ
  61605E0:  1D F1 82 AB FF E2 05 57 - FE C5 0B AE 39 8B 17 5C  .ñ‚«ÿâ.WþÅ.®9‹.\
  61605F0:  72 16 2F B8 21 2C 5E 70 - 42 58 BC E0 41 B0 78 C1  r./¸!,^pBX¼àA°xÁ
Author:  HaQue [ March 31st, 2016, 20:07 ]
Post subject:  Re: Monolith - Repeating Hex Data
at a quick glance, without looking at it closely... It may be what Sergey calls "each 3 pages is the same" which could mean it is a wl ver2 chip..

what is the nand ID, and monolith/pinout type?

It could also be the XOR key, maybe a virus but that's rare
Author:  ddrecovery [ March 31st, 2016, 20:14 ]
Post subject:  Re: Monolith - Repeating Hex Data
HaQue wrote:
at a quick glance, without looking at it closely... It may be what Sergey calls "each 3 pages is the same" which could mean it is a wl ver2 chip..

what is the nand ID, and monolith/pinout type?

It could also be the XOR key, maybe a virus but that's rare

Sorry I should have clarified. This is the Hex data before a pinout, just with a Hex reader of what is actually on the chip.
Author:  HaQue [ March 31st, 2016, 23:29 ]
Post subject:  Re: Monolith - Repeating Hex Data
ahh..
Quote:
Sorry I should have clarified. This is the Hex data before a pinout, just with a Hex reader of what is actually on the chip.

you mean opening the device in DMDE or winhex through its normal USB interface? Then probably not worth monolith recovery via nand pinout. I would do an image of the whole device and then scan it. Maybe look for IOC's on the systems it was used on (check your DR Rig as well!!!)

then have you tried scanning with r-studio or the like?

whats supposed to be on it? files, camera photo data, video, phone data?

Is there a FAT?

you may be looking at sector updates, where the controller caches sectors and consolidates the changes into one write when worthwhile.

could be encryption as well. hard to know without context.
Author:  arvika [ April 1st, 2016, 3:52 ]
Post subject:  Re: Monolith - Repeating Hex Data
It is worth read via pinout. It is very common when you have repeating sectors when controller is dead. Usually read directly from nand and assembly the image give good result.
Author:  ddrecovery [ April 1st, 2016, 12:46 ]
Post subject:  Re: Monolith - Repeating Hex Data
HaQue wrote:
ahh..
Quote:
Sorry I should have clarified. This is the Hex data before a pinout, just with a Hex reader of what is actually on the chip.

you mean opening the device in DMDE or winhex through its normal USB interface? Then probably not worth monolith recovery via nand pinout. I would do an image of the whole device and then scan it. Maybe look for IOC's on the systems it was used on (check your DR Rig as well!!!)

then have you tried scanning with r-studio or the like?
whats supposed to be on it? files, camera photo data, video, phone data?
Is there a FAT?
you may be looking at sector updates, where the controller caches sectors and consolidates the changes into one write when worthwhile.
could be encryption as well. hard to know without context.

I have scanned with R-Studio and UFS Pro with the same results. It was full of generic data i.e. pictures MSO files etc. No FAT or any folder structure at all.

arvika wrote:
It is worth read via pinout. It is very common when you have repeating sectors when controller is dead. Usually read directly from nand and assembly the image give good result.

Sounds good. Many thanks.
Author:  lcoughey [ April 1st, 2016, 12:53 ]
Post subject:  Re: Monolith - Repeating Hex Data
I've seen this a lot with both with monolithic and Lexar CF cards over the past year. Chip off / pinout recoveries are the only option.
Author:  ddrecovery [ April 1st, 2016, 13:27 ]
Post subject:  Re: Monolith - Repeating Hex Data
lcoughey wrote:
I've seen this a lot with both with monolithic and Lexar CF cards over the past year. Chip off / pinout recoveries are the only option.

Thanks Luke. Hope all is well in Canada :-). I bet your enjoying our elections......
Page 1 of 1 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/