All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 9 posts ] 
Author Message
 Post subject: Help About Encrypted Disc
PostPosted: December 6th, 2019, 3:26 
Offline

Joined: December 22nd, 2017, 1:34
Posts: 21
Location: TURKEY
Hello everybody

I have a case which is most probably encrypted. But I couldn't found algorithm or encryption software. But there are some interesting clues about algorithm.
First there is no valid MBR on first sector. But there is a sign before partition definition area (BF 92 FE 57). Second: every first bytes of all lines are in a sequence and it is repeating itself on every two sectors. If you look at pictures which I have attached you can see what I want to tell. This is same for whole disc.

I have calculated some part of disc data's entropy and it is above 7.9999+. So disk is encrypted most probably.

Do anybody have any knowledge about fully encrypted discs and signatures about some different encryption softwares. Any information can help me.
Thank you for your replies.

Attachment:
Ekran Alıntısı.JPG
Ekran Alıntısı.JPG [ 114.42 KiB | Viewed 19196 times ]


Attachments:
Ekran Alıntısı2.JPG
Ekran Alıntısı2.JPG [ 129.8 KiB | Viewed 19196 times ]
Top
 Profile  
 
 Post subject: Re: Help About Encrypted Disc
PostPosted: December 6th, 2019, 15:27 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15462
Location: Australia
It would be better if you uploaded a BIN file.

Sector 0 does indeed have MBR code of some type, but the partition table is empty. Is that what you meant to say?

As for entropy, ISTM that it could be quite low, but we would need to see all the data to be sure. In your example, each group of 4 bytes can be derived from the previous group by adding 0x50 to each byte. If that's encryption, then it is very strange.

Code:
03  B7  AB  DF

+50 +50 +50 +50

53  07  FB  2F

A3  57  4B  7F
F3  A7  9B  CF
43  F7  EB  1F
93  47  3B  6F
...
13  C7  BB  EF

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Help About Encrypted Disc
PostPosted: December 7th, 2019, 2:49 
Offline

Joined: September 10th, 2018, 5:48
Posts: 95
Location: India
datarikaviri wrote:
Hello everybody

I have a case which is most probably encrypted. But I couldn't found algorithm or encryption software. But there are some interesting clues about algorithm.
First there is no valid MBR on first sector. But there is a sign before partition definition area (BF 92 FE 57). Second: every first bytes of all lines are in a sequence and it is repeating itself on every two sectors. If you look at pictures which I have attached you can see what I want to tell. This is same for whole disc.

I have calculated some part of disc data's entropy and it is above 7.9999+. So disk is encrypted most probably.

Do anybody have any knowledge about fully encrypted discs and signatures about some different encryption softwares. Any information can help me.
Thank you for your replies.

Attachment:
Ekran Alıntısı.JPG



Can you share case details in brief?


Top
 Profile  
 
 Post subject: Re: Help About Encrypted Disc
PostPosted: December 10th, 2019, 3:11 
Offline

Joined: December 22nd, 2017, 1:34
Posts: 21
Location: TURKEY
Hello again and thanks for your replies.

Yes fzabkar you understand me correctly about MBR. It does'nt have any partition table.

I have examined image deeply and I have found that disk data is repeating itself in every 4 MB. do you have any idea about this? I think someone filled drive with some random data maybe.


Top
 Profile  
 
 Post subject: Re: Help About Encrypted Disc
PostPosted: December 10th, 2019, 5:15 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 15462
Location: Australia
I couldn't find a match for the MBR code at the following site:

https://thestarman.pcministry.com/asm/mbr/index.html

This leads me to suspect that the MBR code is not Microsoft code. Are you able to disassemble it? (I probably could, but I have other things to do ATM.)

If you compress the drive's image, does it shrink to a very small size? ISTM that it should, given that the data repeat at 4MB intervals.

In any case, ISTM that there is no data to be recovered. Otherwise, could you be witnessing a weird firmware problem where the drive is returning garbage (I don't think so) ???

_________________
A backup a day keeps DR away.


Top
 Profile  
 
 Post subject: Re: Help About Encrypted Disc
PostPosted: December 11th, 2019, 3:43 
Offline

Joined: December 22nd, 2017, 1:34
Posts: 21
Location: TURKEY
I think we dont need to compress data to be sure data is repeating itself. I have divided image to 4MB parts. Then calculated hash values and I am sure data is repeating itself because hash values are same. Actually there are just 4 different hash values in 110000+ files which are same size.


Top
 Profile  
 
 Post subject: Re: Help About Encrypted Disc
PostPosted: December 11th, 2019, 3:49 
Offline

Joined: November 29th, 2006, 10:08
Posts: 7843
Location: UK
Is this an SSD or a mechanical drive?

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!


Top
 Profile  
 
 Post subject: Re: Help About Encrypted Disc
PostPosted: December 11th, 2019, 3:52 
Offline

Joined: December 22nd, 2017, 1:34
Posts: 21
Location: TURKEY
pcimage wrote:
Is this an SSD or a mechanical drive?

This is mechanical drive.


Top
 Profile  
 
 Post subject: Re: Help About Encrypted Disc
PostPosted: December 11th, 2019, 3:56 
Offline

Joined: November 29th, 2006, 10:08
Posts: 7843
Location: UK
Ok, in that case there can be little doubt the data has been wiped out :-(

If the “data” is indeed repeating itself byte-for-byte every 4Mb then it’s not real data, something (or someone) must have overwritten the drive with this repeating data set. Either that or some obscure FW bug, but I doubt that very much.

_________________
PC Image Data Recovery
http://www.pcimage.co.uk

New!! HDD-PCB.COM for all your PCB and donor HDD requirements!


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 9 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 6 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group