Hi all,

Maybe someone has seen this?

This is the 4th drive we get with the same behavior. The first one we saw in 2017, then we got 3 more until today.
All 4 drives are TeamGroup branded and model is L7 EVO.
They would read green sectors and append a "Game Over!!!" signature in a loop.
All other sectors are zeroed.
The controller seems to work (I've tried changing one byte and changes were saved successfully).

The first drive we got in 2017 would have an intact MBR and then nothing. The other 3 drives were simply zeroed with this signature (no MBR or other meta).
It's very, very strange to me.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

Odd - Any clues in the history given from the client? It has almost a hardware bug or malware feel to it.

_________________
Data Recovery Services in the UK.
https://www.usbrecovery.co.uk/

I would suggest to dump the firmware and grep for "Game Over", perhaps it's a way for the firmware to signal a bad sector read.

That's a Marvell 88NV1120 ssd controller inside with a failed translator module. That's how it behaves when the translator is gone. Unfortunately no commercial tool is able to work with this controller (correct me if I'm wrong).
There is a tool that can repair the ssd, by rebuilding the translator, but of course, you'll loose all the data in the process.

_________________
www.datasave.ro

Thanks everyone for your feedback.

I dug a little into the fw as suggested by sourcerer.

ccc is right, signature comes from drive's fw when translator is gone.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

Ow wow. Now I feel like I am in a Mr. Robot episode

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service

FW developers have a strange humor

_________________
Digitalsupport Data Recovery
https://digitalsupport.dk

concerning humor, all the hard disk firmwares are full of dead beef, dead food, dead face, Beef Food and so on.

pepe

_________________
Adatmentés - Data recovery

I still remember the first time in my life I witnesses "DE AD BE EF". I was literally "wtf, really now?"

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

_________________
Joep - http://www.disktuna.com - video & photo repair & recovery service

Hey Guys,

i have a ADATA SP580 with this Marvell 88nv1120 Controller and the same behavior.

Gets Full ID, access is a little bit weak and shown sectors are empty.

Any advice to fix?

No commercial tool available to fix/bypass the translator problem, so for now it's game over I'm afraid.
This isn't a very popular controller so we didn't spend time researching it, not worth it.

Maybe Ace will add this controller in future releases.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

I'm sorry to revive this old thread. I've got a Foresee 128GB SSD V3.12 S40j Sata M.2 with the exactly same Marvell 88nv1120 controller and this "Game Over!!!" message in hex view. Is the controller now supported by pc3k?

Thanks in advance.

Still not supported and not likely to be either, https://blog.acelab.eu.com/pc-3000-ssd- ... dated.html

_________________
Data Recovery Services in the UK.
https://www.usbrecovery.co.uk/