MultiDrive – free backup, clone & wipe disk utility from Atola Technology

Main » Forums home » Flash storage, SSD

All times are UTC - 5 hours [ DST ]



Post new topic Reply to topic  Page 1 of 2
  [ 24 posts ]  Go to page 1, 2  Next
  Print view Previous topic | Next topic 
Author Message
melvin
 Post subject: mSD Sandisk 64GB cracked-good read via NAND-almost no data
PostPosted: July 1st, 2021, 4:08 
Offline
User avatar

Joined: September 16th, 2015, 9:06
Posts: 348
Location: Poland
Hello,

Got this cracked mSD card. I got full ID via NAND 453EAAA2, got memory dump, corrected and reread in more than 95%. Some red blocks here and there but most is good. So it's not a situation where bad blocks would ruin every file. It was used in many phones. Last one was Xiaomi Mi A2 Lite. I recovered only 69 jpegs, 10 of them work good. They are old, from another phone. I scanned the dump in every possible way. Results are the same. Client doesn't know if the card was encrypted by the phone.

But, if it was encrypted, why did i find some old pictures? It should be encrypted in 100%, right?
Looking for someone with more experience willing to check it.


Attachments:
img_0002 (1).jpg
img_0002 (1).jpg [ 118.54 KiB | Viewed 17363 times ]

_________________
odzyskiwanie danych
Top
 Profile  
 
Lardman
 Post subject: Re: mSD Sandisk 64GB cracked-good read via NAND-almost no da
PostPosted: July 1st, 2021, 4:28 
Offline

Joined: November 7th, 2020, 5:31
Posts: 1290
Location: United Kingdom
Phones aren't my thing but AFAIK they encrypt the fs not the device - assuming you read it as chip off. What's it look like in hex and have you run anything to check the entropy of the image?

_________________
Data Recovery Services in the UK.
https://www.usbrecovery.co.uk/
Top
 Profile  
 
einstein9
 Post subject: Re: mSD Sandisk 64GB cracked-good read via NAND-almost no da
PostPosted: July 1st, 2021, 4:36 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2821
Location: Kuwait
Xiaomi Mi A2 Lite came with Android 8.1 (encrypted Internal phone mem) BUT MicroSD is NOT by default unless you do manually.

Now, am not sure about Xiaomi but in Huawei for example you can set Default Mem as the MicroSD for example here and by then will be Encrypted (some cases)

BUT if you leave it as a default (not enc.) and you set Camera saving to MicroSD then its not Enc. (FAT32)
which i believe your case here and that is why you are getting some images.

Conclusion

Check those images/Apps/files footage details (dates) and ask your client, he is the only one who should know

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein
Top
 Profile  
 
melvin
 Post subject: Re: mSD Sandisk 64GB cracked-good read via NAND-almost no da
PostPosted: July 1st, 2021, 4:59 
Offline
User avatar

Joined: September 16th, 2015, 9:06
Posts: 348
Location: Poland
He has no clue, phone is long gone.

Photos i recovered are from 2015, from another phone the mSD was used in. Photos from Xiaomi are not recovered. My answear would be that they were encrypted but if so, does the phone encrypt only new data? Cause that's the only idea i got to answer the question, why i recovered few old photos. There should be more of them anyway. This card was used for few years and photos were collected in fidderent folders.
Can't recover the structure, only RAW results.

_________________
odzyskiwanie danych
Top
 Profile  
 
Arch Stanton
 Post subject: Re: mSD Sandisk 64GB cracked-good read via NAND-almost no da
PostPosted: July 1st, 2021, 5:35 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 1150
Location: Nederland
It's possible files are individually encrypted (FBE). If you scan with my tool JpegDigger (the logical image) you may be able to tell by looking at entropy map (cyan = encryption-ish entropy) although that's not conclusive 'evidence'. Also individually encrypted files I see contain string "CONSOLE".

Attachment:
console.png
console.png [ 9.76 KiB | Viewed 17341 times ]

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service
Top
 Profile  
 
melvin
 Post subject: Re: mSD Sandisk 64GB cracked-good read via NAND-almost no da
PostPosted: July 1st, 2021, 7:39 
Offline
User avatar

Joined: September 16th, 2015, 9:06
Posts: 348
Location: Poland
Didn't find any "CONSOLE" except console.log files.
Jpegdigger cannot determine the file system type. Used override, set 64GB but when pressed "scan" i get:

Run-time error `13:
Type mismatch

and the program closes.

Funny thing is that beginning of logican image looks good. Looks like fat, many words can be recognized like "scroll the app" but the rest looks like garbage.

_________________
odzyskiwanie danych
Top
 Profile  
 
Arch Stanton
 Post subject: Re: mSD Sandisk 64GB cracked-good read via NAND-almost no da
PostPosted: July 1st, 2021, 10:03 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 1150
Location: Nederland
melvin wrote:
Didn't find any "CONSOLE" except console.log files.
Jpegdigger cannot determine the file system type. Used override, set 64GB but when pressed "scan" i get:

Run-time error `13:
Type mismatch

and the program closes.

Funny thing is that beginning of logican image looks good. Looks like fat, many words can be recognized like "scroll the app" but the rest looks like garbage.


Well how about that!? I scanned 100's of cards, disk images and what not, I recommend it here once and it crashes! Sorry about that. I can not replicate doing steps you took, maybe something specific with that file. Can only fix if I have the file (or possibly even part of it) if you and would be willing to share.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service
Top
 Profile  
 
melvin
 Post subject: Re: mSD Sandisk 64GB cracked-good read via NAND-almost no da
PostPosted: July 1st, 2021, 11:24 
Offline
User avatar

Joined: September 16th, 2015, 9:06
Posts: 348
Location: Poland
Link sent.

_________________
odzyskiwanie danych
Top
 Profile  
 
Arch Stanton
 Post subject: Re: mSD Sandisk 64GB cracked-good read via NAND-almost no da
PostPosted: July 1st, 2021, 11:39 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 1150
Location: Nederland
Thank you!!

Of course here it just runs fine. Weird. You were using 2.6.280 too?

https://imgur.com/bSyOiPj

Cyan = superhigh entropy which suggests it's encrypted data.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service
Top
 Profile  
 
arvika
 Post subject: Re: mSD Sandisk 64GB cracked-good read via NAND-almost no da
PostPosted: July 1st, 2021, 15:36 
Offline

Joined: October 24th, 2009, 15:22
Posts: 917
Location: Poland
Its easy to check if encrypted. Look for partition with
"android meta"
"android expand"

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices
Top
 Profile  
 
arvika
 Post subject: Re: mSD Sandisk 64GB cracked-good read via NAND-almost no da
PostPosted: August 5th, 2021, 12:07 
Offline

Joined: October 24th, 2009, 15:22
Posts: 917
Location: Poland
What was the result?

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices
Top
 Profile  
 
Amarbir[CDR-Labs]
 Post subject: Re: mSD Sandisk 64GB cracked-good read via NAND-almost no da
PostPosted: August 5th, 2021, 12:36 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3522
Location: CDRLabs @ Chandigarh [ India ]
arvika wrote:
Its easy to check if encrypted. Look for partition with
"android meta"
"android expand"


Hello,
IF you see these then its encrypted or whats the story ,I do not work on mobiles and mobile MSD so interested to know

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com
Top
 Profile  
 
Arch Stanton
 Post subject: Re: mSD Sandisk 64GB cracked-good read via NAND-almost no da
PostPosted: August 5th, 2021, 14:30 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 1150
Location: Nederland
Amarbir[CDR-Labs] wrote:
arvika wrote:
Its easy to check if encrypted. Look for partition with
"android meta"
"android expand"


Hello,
IF you see these then its encrypted or whats the story ,I do not work on mobiles and mobile MSD so interested to know


Okay. But I often get the files with story that they're corrupt, so I do not have this folder structure. If they're FBE encrypted I have seen this CONSOLE string many times and also seen it mentioned in other forums. So that's what I always check for.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service
Top
 Profile  
 
arvika
 Post subject: Re: mSD Sandisk 64GB cracked-good read via NAND-almost no da
PostPosted: August 5th, 2021, 15:02 
Offline

Joined: October 24th, 2009, 15:22
Posts: 917
Location: Poland
Case from today. RAW scan gives nothing. Card is crypted by mobile phone.


Attachments:
android_crypt.jpg
android_crypt.jpg [ 30.72 KiB | Viewed 15458 times ]

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices
Top
 Profile  
 
Arch Stanton
 Post subject: Re: mSD Sandisk 64GB cracked-good read via NAND-almost no da
PostPosted: August 5th, 2021, 15:32 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 1150
Location: Nederland
arvika wrote:
Case from today. RAW scan gives nothing. Card is crypted by mobile phone.


Can you open a JPEG just for laughs? And see if they have this CONSOLE string in header?

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service
Top
 Profile  
 
arvika
 Post subject: Re: mSD Sandisk 64GB cracked-good read via NAND-almost no da
PostPosted: August 5th, 2021, 16:03 
Offline

Joined: October 24th, 2009, 15:22
Posts: 917
Location: Poland
Arch Stanton wrote:
Can you open a JPEG just for laughs? And see if they have this CONSOLE string in header?


It is not possible, because I do not found any file headers. String CONSOLE is absent too at image.

_________________
Flash Killer - everyday new resources (pinout, XOR, ECC,config) for flash devices
Top
 Profile  
 
Arch Stanton
 Post subject: Re: mSD Sandisk 64GB cracked-good read via NAND-almost no da
PostPosted: August 5th, 2021, 16:16 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 1150
Location: Nederland
Ah, I see. No folder tree either? So entire volume is encrypted? Probably CONSOLE string is in files encrypted with file based encryption. So your card was configured as internal memory. Other option is as portable storage and in that case encryption is optional. And if enabled it's probably FBE AFAIK.

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service
Top
 Profile  
 
Amarbir[CDR-Labs]
 Post subject: Re: mSD Sandisk 64GB cracked-good read via NAND-almost no da
PostPosted: August 5th, 2021, 21:08 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3522
Location: CDRLabs @ Chandigarh [ India ]
Arch Stanton wrote:
Ah, I see. No folder tree either? So entire volume is encrypted? Probably CONSOLE string is in files encrypted with file based encryption. So your card was configured as internal memory. Other option is as portable storage and in that case encryption is optional. And if enabled it's probably FBE AFAIK.


Obviously ,
Its never a File Based Encryption in these i guess

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com
Top
 Profile  
 
Arch Stanton
 Post subject: Re: mSD Sandisk 64GB cracked-good read via NAND-almost no da
PostPosted: August 6th, 2021, 6:06 
Offline
User avatar

Joined: May 13th, 2019, 7:50
Posts: 1150
Location: Nederland
[quote="Amarbir[CDR-Labs]"

Obviously ,
Its never a File Based Encryption in these i guess[/quote]

What do you mean? What's obvious and what do you mean by 'these'?

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service
Top
 Profile  
 
Amarbir[CDR-Labs]
 Post subject: Re: mSD Sandisk 64GB cracked-good read via NAND-almost no da
PostPosted: August 6th, 2021, 10:32 
Offline
User avatar

Joined: August 15th, 2006, 3:01
Posts: 3522
Location: CDRLabs @ Chandigarh [ India ]
Arch Stanton wrote:
[quote="Amarbir[CDR-Labs]"

Obviously ,
Its never a File Based Encryption in these i guess


What do you mean? What's obvious and what do you mean by 'these'?[/quote]

Hi,
By These i mean mobile phones and the way they encrypt the MSD cards

_________________
Regards
Amarbir S Dhillon , Chandigarh Data Recovery Labs [India]
Logical,Semi Physical And Physical Data Recovery
Website-> http://www.chandigarhdatarecovery.com
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  Page 1 of 2
  [ 24 posts ]  Go to page 1, 2  Next

Main » Forums home » Flash storage, SSD

All times are UTC - 5 hours [ DST ]

Who is online

Users browsing this forum: No registered users and 12 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Switch to mobile style
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group