HDD GURU FORUMS
http://forum.hddguru.com/

SSD imaged with data seemingly out of order
http://forum.hddguru.com/viewtopic.php?f=10&t=43392		 Page 1 of 1
Author:  jordash [ June 5th, 2023, 23:55 ]
Post subject:  SSD imaged with data seemingly out of order
I have an Intel 545S Series SSD which stopped working normally. The only way I could get it to read any data at all was with DDI in PIO mode. Anything else I tried would not allow any access to any sector. There was data across the whole drive, but it wasn't reading correctly, the first sectors were not a partition table, nothing was where you'd expect it to be.

It took a while but the whole 512gb was imaged at about 1mb/s without any errors, but the data appears to be out of its correct order. When I scan the full image in UFS it picks up an intact file system containing a Windows installation as it should with all the records for the user data showing as expected, but the data appears to be shifted, nothing is in the locations it should be. It could be a problem with the translator, but I know PC3k doesn't support this drive.

Has anyone seen something like this?
Author:  fzabkar [ June 6th, 2023, 0:57 ]
Post subject:  Re: SSD imaged with data seemingly out of order
ISTR an old thread where PC3K's "PIO mode" was equated with CHS mode. In CHS mode, sector #1 (C/H/S = 0/0/1) is LBA 0.

At which LBA does UFS find the MBR?
Author:  jordash [ June 6th, 2023, 7:26 ]
Post subject:  Re: SSD imaged with data seemingly out of order
I don't think UFS will specifically tell you where its seeing a MBR.

I've tried searching through the hex of the entire clone for "EFI PART", there was lots of instances of it but none looked like it was from the MBR. Is there another way to find definite reference point to work from do you think?
Author:  fzabkar [ June 6th, 2023, 13:15 ]
Post subject:  Re: SSD imaged with data seemingly out of order
Try reading the single sector at LBA 1 in PIO mode. Do you see an MBR? Also try reading LBA 2. Do you see EFI PART?

I would perform a test. CHS mode has a capacity limit of 8GB. I would use VNR's pattern writer tool, or similar, to write "data = LBA #" to the first 10GB of a test device, either SSD or HDD. Then use PC3K's PIO mode to clone this 10GB region. Now examine the image file and check the correspondence between the data and the actual LBA.
Author:  Arch Stanton [ June 6th, 2023, 16:08 ]
Post subject:  Re: SSD imaged with data seemingly out of order
jordash wrote:
I don't think UFS will specifically tell you where its seeing a MBR.

I've tried searching through the hex of the entire clone for "EFI PART", there was lots of instances of it but none looked like it was from the MBR. Is there another way to find definite reference point to work from do you think?


I'd look for boot records and check if they are where they 'pretend to be'. For example, here I use DMDE Special Sector Search ad ticked exFAT and NTFS boot sectors.

https://youtu.be/5RClVfg-uOk

Attachment:
special-sector-srch.jpg
special-sector-srch.jpg [ 142.83 KiB | Viewed 2144 times ]


Usually (but not always) hidden sector field will correspond with the LBA address at which the sector is detected. If they don't it may be a bogus find, to check you could double click in the editor field (blue in my example), accept values from boot sector and try open the volume. If it resolves to a valid volume the bootsector may be right.

Anyway, if a boot sector claims to be in sector nnnn, go back nnnn sectors and you should find yourself in the MBR.

If you can't find a single boot sector with hidden sectors that corresponds with the LBA address, translator issue perhaps?

I just read a paper called "Understanding the Robustness of SSDs under Power Fault" that suggests this is not too far fetched as result of sudden loss of power.
Author:  jordash [ June 8th, 2023, 9:54 ]
Post subject:  Re: SSD imaged with data seemingly out of order
I can't find a MBR that looks correct anywhere across the drive. I've done searches in the hex for partial sequences from other files that I know are on the drive, and I can't find them either. So its not just like the data has been horizontally translated in one direction, it has to be something more complicated. Doing a raw recovery across the drive returns lots of files, but it doesn't seem like there's enough files in total for what you'd expect from a Windows installation.

I've managed to get some sectors reading DE with lots of errors, (DDI had no errors) and the sectors that can be read in DE match exactly with those read in DDI.

The weird part is the file system seems intact, and even more weird is that there are a few files that actually work perfectly, the rest seems like the records are all pointing to the wrong data.
Author:  Arch Stanton [ June 8th, 2023, 11:06 ]
Post subject:  Re: SSD imaged with data seemingly out of order
If you find start of MFT though you may be able to investigate if there's some order in all of this. MFT records are numbered, 1KB in size, first chunk of MFT is usually one contiguous chunk. So if MFT is interrupted and perhaps picks up again, drops and picks up again etc., you can possibly draw some conclusions as if you were solving a RAID. Or maybe conclusion is that it appears to be totally random. But looking for an MBR and not finding it isn't decisive.

Did you try the special sector search option in DMDE? Do you find any and does any resolve to a file system?

I was reading "Understanding the Impact of Power Loss on Flash Memory" - Hung-Wei Tseng, the other day and something like sudden power loss could be responsible for silently corrupting the translator. If you have something like that at hand I have no idea what to do, I don't have stuff like PC3000 and can not tell if and how it is helpful.
Author:  fzabkar [ June 8th, 2023, 18:11 ]
Post subject:  Re: SSD imaged with data seemingly out of order
Was this drive coupled with Optane???
Author:  csava [ June 13th, 2023, 9:48 ]
Post subject:  Re: SSD imaged with data seemingly out of order
I have encountered such a case. You can check whether there is any abnormality in the smart project. What I encountered was the abnormal writing and reading volume of SSD, which reached the EB level. This is obviously abnormal, and it is obviously impossible for inte 3D 64L TLC to achieve this kind of durability. I think the cause of the failure is a bit error due to nand degradation, which leads to an error in the SSD service module, but I have no solution to verify my guess, because the controller uses intel-customized SMI2259G, which is not supported by PC3000 SSD
Author:  jordash [ June 13th, 2023, 10:25 ]
Post subject:  Re: SSD imaged with data seemingly out of order
fzabkar wrote:
Was this drive coupled with Optane???


No definitely didn't have anything non-standard going on like that, just a stand alone drive with a Windows installation. I can find the beginning of the MFT but I can't deduce anything helpful from it. It must be something to do with the translator being messed up that's all I can think of.
Page 1 of 1 All times are UTC - 5 hours [ DST ]
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group
http://www.phpbb.com/