CompactFlash, SD, MMC, USB flash storage. Anything that does not have moving parts inside.
Post a reply

Drive is mostly zeros

June 21st, 2023, 16:07

Is it common or even possible for a SSD controller to fail in a way that it just reports zeros when reading some parts of the drive?

That is a possibility I am considering given a customer who presented the following issue:

A large Samsung 4TB USB external SSD drive which had approximately 50% usage comprised of jpg files.
I imaged the drive with no errors.
R-Studio found less than a dozen jpg files.
I scanned the disk image byte-by-byte and found that > 99% of all bytes were '\0'.

I told the customer that something had to have written over their data.
They insisted that it was not possible and additionally when I asked them further questions they said that all of their files were there one moment and then gone the next.
They claim that there was not enough time to overwrite data.

Puzzling.

Re: Drive is mostly zeros

June 21st, 2023, 16:13

Trim, garbage collection, duff translator. Just about anything is a WAG without knowing what the client actually did.

Re: Drive is mostly zeros

June 21st, 2023, 16:17

I have no idea what you mean? :)
NO clue what a duff translator or a WAG is???

But, it seems that you say the drive actually has zeros and the client did something to put them there??

Re: Drive is mostly zeros

June 21st, 2023, 16:18

Lardman wrote:Trim, garbage collection, duff translator. Just about anything is a WAG without knowing what the client actually did.



I have no idea what you mean? :)
NO clue what a duff translator or a WAG is???

But, it seems that you say the drive actually has zeros and the client did something to put them there??

Thank you.

Re: Drive is mostly zeros

June 21st, 2023, 16:31

WAG = Wild Arsed Guess (arse = the sum of two half-asses)

"Duff translator" means that the internal firmware component which maps (translates) logical blocks to physical blocks has become corrupt.

TRIM was most likely invoked by the OS after the customer deleted their files or formatted their drive. The drive then returns zeros for the TRIM-ed LBAs.

https://duckduckgo.com/?q=SSD+trim

TRIM and file deletion - Why undelete / recovery is (often) impossible from SSD drives:
https://www.youtube.com/watch?v=NyLQbxnPurc

Re: Drive is mostly zeros

June 21st, 2023, 22:33

fzabkar, Lardman,
Thank you very much for taking the time to respond to my post.
I learned alot from the links you sent!
Post a reply