mSD Sandisk 64GB cracked-good read via NAND-almost no data

[melvin]

Hello,

Got this cracked mSD card. I got full ID via NAND 453EAAA2, got memory dump, corrected and reread in more than 95%. Some red blocks here and there but most is good. So it's not a situation where bad blocks would ruin every file. It was used in many phones. Last one was Xiaomi Mi A2 Lite. I recovered only 69 jpegs, 10 of them work good. They are old, from another phone. I scanned the dump in every possible way. Results are the same. Client doesn't know if the card was encrypted by the phone.

But, if it was encrypted, why did i find some old pictures? It should be encrypted in 100%, right?
Looking for someone with more experience willing to check it.

Attachments

[Lardman]

Phones aren't my thing but AFAIK they encrypt the fs not the device - assuming you read it as chip off. What's it look like in hex and have you run anything to check the entropy of the image?

[einstein9]

Xiaomi Mi A2 Lite came with Android 8.1 (encrypted Internal phone mem) BUT MicroSD is NOT by default unless you do manually.

Now, am not sure about Xiaomi but in Huawei for example you can set Default Mem as the MicroSD for example here and by then will be Encrypted (some cases)

BUT if you leave it as a default (not enc.) and you set Camera saving to MicroSD then its not Enc. (FAT32)
which i believe your case here and that is why you are getting some images.

Conclusion

Check those images/Apps/files footage details (dates) and ask your client, he is the only one who should know

[melvin]

He has no clue, phone is long gone.

Photos i recovered are from 2015, from another phone the mSD was used in. Photos from Xiaomi are not recovered. My answear would be that they were encrypted but if so, does the phone encrypt only new data? Cause that's the only idea i got to answer the question, why i recovered few old photos. There should be more of them anyway. This card was used for few years and photos were collected in fidderent folders.
Can't recover the structure, only RAW results.

[Arch Stanton]

It's possible files are individually encrypted (FBE). If you scan with my tool JpegDigger (the logical image) you may be able to tell by looking at entropy map (cyan = encryption-ish entropy) although that's not conclusive 'evidence'. Also individually encrypted files I see contain string "CONSOLE".

console.png (9.76 KiB) Viewed 13843 times

[melvin]

Didn't find any "CONSOLE" except console.log files.
Jpegdigger cannot determine the file system type. Used override, set 64GB but when pressed "scan" i get:

Run-time error `13:
Type mismatch

and the program closes.

Funny thing is that beginning of logican image looks good. Looks like fat, many words can be recognized like "scroll the app" but the rest looks like garbage.

[Arch Stanton]

Didn't find any "CONSOLE" except console.log files.
Jpegdigger cannot determine the file system type. Used override, set 64GB but when pressed "scan" i get:

Run-time error `13:
Type mismatch

and the program closes.

Funny thing is that beginning of logican image looks good. Looks like fat, many words can be recognized like "scroll the app" but the rest looks like garbage.

Well how about that!? I scanned 100's of cards, disk images and what not, I recommend it here once and it crashes! Sorry about that. I can not replicate doing steps you took, maybe something specific with that file. Can only fix if I have the file (or possibly even part of it) if you and would be willing to share.

[melvin]

Link sent.

[Arch Stanton]

Thank you!!

Of course here it just runs fine. Weird. You were using 2.6.280 too?

https://imgur.com/bSyOiPj

Cyan = superhigh entropy which suggests it's encrypted data.

[arvika]

Its easy to check if encrypted. Look for partition with
"android meta"
"android expand"

[arvika]

What was the result?

[Amarbir[CDR-Labs]]

Its easy to check if encrypted. Look for partition with
"android meta"
"android expand"

Hello,
IF you see these then its encrypted or whats the story ,I do not work on mobiles and mobile MSD so interested to know

[Arch Stanton]

Its easy to check if encrypted. Look for partition with
"android meta"
"android expand"

Hello,
IF you see these then its encrypted or whats the story ,I do not work on mobiles and mobile MSD so interested to know

Okay. But I often get the files with story that they're corrupt, so I do not have this folder structure. If they're FBE encrypted I have seen this CONSOLE string many times and also seen it mentioned in other forums. So that's what I always check for.

[arvika]

Case from today. RAW scan gives nothing. Card is crypted by mobile phone.

Attachments

[Arch Stanton]

Case from today. RAW scan gives nothing. Card is crypted by mobile phone.

Can you open a JPEG just for laughs? And see if they have this CONSOLE string in header?

[arvika]

Can you open a JPEG just for laughs? And see if they have this CONSOLE string in header?

It is not possible, because I do not found any file headers. String CONSOLE is absent too at image.

[Arch Stanton]

Ah, I see. No folder tree either? So entire volume is encrypted? Probably CONSOLE string is in files encrypted with file based encryption. So your card was configured as internal memory. Other option is as portable storage and in that case encryption is optional. And if enabled it's probably FBE AFAIK.

[Amarbir[CDR-Labs]]

Ah, I see. No folder tree either? So entire volume is encrypted? Probably CONSOLE string is in files encrypted with file based encryption. So your card was configured as internal memory. Other option is as portable storage and in that case encryption is optional. And if enabled it's probably FBE AFAIK.

Obviously ,
Its never a File Based Encryption in these i guess

[Arch Stanton]

[quote="Amarbir[CDR-Labs]"

Obviously ,
Its never a File Based Encryption in these i guess[/quote]

What do you mean? What's obvious and what do you mean by 'these'?

[Amarbir[CDR-Labs]]

[quote="Amarbir[CDR-Labs]"

Obviously ,
Its never a File Based Encryption in these i guess

What do you mean? What's obvious and what do you mean by 'these'?[/quote]

Hi,
By These i mean mobile phones and the way they encrypt the MSD cards