All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 10 posts ] 
Author Message
 Post subject: SSD imaged with data seemingly out of order
PostPosted: June 5th, 2023, 23:55 
Offline

Joined: June 11th, 2017, 1:16
Posts: 42
Location: Australia
I have an Intel 545S Series SSD which stopped working normally. The only way I could get it to read any data at all was with DDI in PIO mode. Anything else I tried would not allow any access to any sector. There was data across the whole drive, but it wasn't reading correctly, the first sectors were not a partition table, nothing was where you'd expect it to be.

It took a while but the whole 512gb was imaged at about 1mb/s without any errors, but the data appears to be out of its correct order. When I scan the full image in UFS it picks up an intact file system containing a Windows installation as it should with all the records for the user data showing as expected, but the data appears to be shifted, nothing is in the locations it should be. It could be a problem with the translator, but I know PC3k doesn't support this drive.

Has anyone seen something like this?


Top
 Profile  
 
 Post subject: Re: SSD imaged with data seemingly out of order
PostPosted: June 6th, 2023, 0:57 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
ISTR an old thread where PC3K's "PIO mode" was equated with CHS mode. In CHS mode, sector #1 (C/H/S = 0/0/1) is LBA 0.

At which LBA does UFS find the MBR?

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: SSD imaged with data seemingly out of order
PostPosted: June 6th, 2023, 7:26 
Offline

Joined: June 11th, 2017, 1:16
Posts: 42
Location: Australia
I don't think UFS will specifically tell you where its seeing a MBR.

I've tried searching through the hex of the entire clone for "EFI PART", there was lots of instances of it but none looked like it was from the MBR. Is there another way to find definite reference point to work from do you think?


Top
 Profile  
 
 Post subject: Re: SSD imaged with data seemingly out of order
PostPosted: June 6th, 2023, 13:15 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
Try reading the single sector at LBA 1 in PIO mode. Do you see an MBR? Also try reading LBA 2. Do you see EFI PART?

I would perform a test. CHS mode has a capacity limit of 8GB. I would use VNR's pattern writer tool, or similar, to write "data = LBA #" to the first 10GB of a test device, either SSD or HDD. Then use PC3K's PIO mode to clone this 10GB region. Now examine the image file and check the correspondence between the data and the actual LBA.

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: SSD imaged with data seemingly out of order
PostPosted: June 6th, 2023, 16:08 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
jordash wrote:
I don't think UFS will specifically tell you where its seeing a MBR.

I've tried searching through the hex of the entire clone for "EFI PART", there was lots of instances of it but none looked like it was from the MBR. Is there another way to find definite reference point to work from do you think?


I'd look for boot records and check if they are where they 'pretend to be'. For example, here I use DMDE Special Sector Search ad ticked exFAT and NTFS boot sectors.

https://youtu.be/5RClVfg-uOk

Attachment:
special-sector-srch.jpg
special-sector-srch.jpg [ 142.83 KiB | Viewed 1945 times ]


Usually (but not always) hidden sector field will correspond with the LBA address at which the sector is detected. If they don't it may be a bogus find, to check you could double click in the editor field (blue in my example), accept values from boot sector and try open the volume. If it resolves to a valid volume the bootsector may be right.

Anyway, if a boot sector claims to be in sector nnnn, go back nnnn sectors and you should find yourself in the MBR.

If you can't find a single boot sector with hidden sectors that corresponds with the LBA address, translator issue perhaps?

I just read a paper called "Understanding the Robustness of SSDs under Power Fault" that suggests this is not too far fetched as result of sudden loss of power.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: SSD imaged with data seemingly out of order
PostPosted: June 8th, 2023, 9:54 
Offline

Joined: June 11th, 2017, 1:16
Posts: 42
Location: Australia
I can't find a MBR that looks correct anywhere across the drive. I've done searches in the hex for partial sequences from other files that I know are on the drive, and I can't find them either. So its not just like the data has been horizontally translated in one direction, it has to be something more complicated. Doing a raw recovery across the drive returns lots of files, but it doesn't seem like there's enough files in total for what you'd expect from a Windows installation.

I've managed to get some sectors reading DE with lots of errors, (DDI had no errors) and the sectors that can be read in DE match exactly with those read in DDI.

The weird part is the file system seems intact, and even more weird is that there are a few files that actually work perfectly, the rest seems like the records are all pointing to the wrong data.


Top
 Profile  
 
 Post subject: Re: SSD imaged with data seemingly out of order
PostPosted: June 8th, 2023, 11:06 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 907
Location: Nederland
If you find start of MFT though you may be able to investigate if there's some order in all of this. MFT records are numbered, 1KB in size, first chunk of MFT is usually one contiguous chunk. So if MFT is interrupted and perhaps picks up again, drops and picks up again etc., you can possibly draw some conclusions as if you were solving a RAID. Or maybe conclusion is that it appears to be totally random. But looking for an MBR and not finding it isn't decisive.

Did you try the special sector search option in DMDE? Do you find any and does any resolve to a file system?

I was reading "Understanding the Impact of Power Loss on Flash Memory" - Hung-Wei Tseng, the other day and something like sudden power loss could be responsible for silently corrupting the translator. If you have something like that at hand I have no idea what to do, I don't have stuff like PC3000 and can not tell if and how it is helpful.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service


Top
 Profile  
 
 Post subject: Re: SSD imaged with data seemingly out of order
PostPosted: June 8th, 2023, 18:11 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15461
Location: Australia
Was this drive coupled with Optane???

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: SSD imaged with data seemingly out of order
PostPosted: June 13th, 2023, 9:48 
Offline
User avatar

Joined: July 8th, 2019, 12:27
Posts: 147
Location: 中国大陆浙江省湖州市
I have encountered such a case. You can check whether there is any abnormality in the smart project. What I encountered was the abnormal writing and reading volume of SSD, which reached the EB level. This is obviously abnormal, and it is obviously impossible for inte 3D 64L TLC to achieve this kind of durability. I think the cause of the failure is a bit error due to nand degradation, which leads to an error in the SSD service module, but I have no solution to verify my guess, because the controller uses intel-customized SMI2259G, which is not supported by PC3000 SSD

_________________
Auxiliary Tool Used For MonoLith Data Recovery, featuring the industry's most extensive Monolith pinouts
http://flash-matrix.com/


Top
 Profile  
 
 Post subject: Re: SSD imaged with data seemingly out of order
PostPosted: June 13th, 2023, 10:25 
Offline

Joined: June 11th, 2017, 1:16
Posts: 42
Location: Australia
fzabkar wrote:
Was this drive coupled with Optane???


No definitely didn't have anything non-standard going on like that, just a stand alone drive with a Windows installation. I can find the beginning of the MFT but I can't deduce anything helpful from it. It must be something to do with the translator being messed up that's all I can think of.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 10 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 20 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group