Micro SD Part 1Flash Extractor-芯片级数据恢复取证方案025-83608636

Micro SD Part 1

Monolith Micro SD_1 2c 64 44 4b 1x4

Layout
  SD_20 v2 1108_1102 Xor 0561_256
Mix
  Input
    Order  0/1/2/3
  Block Pair
    Block  0x200000
    Page   0x2000
  Join by Dump
    Parts  4
Assembler
  Block Number
    Block Size      0x400000
    Bank Space      0x800
    Banks           00..03 / 0x000 / 0x785
  Actions
    Scan
Comments
  by Arvika
  save image, RAW recovery

Monolith Micro SD_1 2c 68 04 4a 1x2

Layout
  SD_20 1074_1070
Mix
  Input
    Order  0/1
  Join by Page
    Parts  2
    Page   0x1000
  Block Pair
    Block  0x200000
    Page   0x1000
  Block Rotate
    Block  0x400000
    Page   0x2000
Assembler
  Block Number
    Block Size      0x400000
    Bank Space      0x1000
    Banks           00 / 0x000 / 0x7ff
  Actions
    Scan
Comments
  by Arvika
  RAW recovery

Monolith Micro SD_1 2c 84 c5 4b 1x1

Layout
  SD_20 v2 1102_1096 Xor 0561_256
Mix
  Input
    Order  0
  Block Pair
    Block  0x200000
    Page   0x2000
Assembler
  Block Number
    Block Size      0x400000
    Bank Space      0x1000
    Banks           00 / 0x000 / 0xfff
  Actions
    Scan
Comments
  by Arvika
  save image, RAW recovery

Monolith Micro SD_1 2c 88 05 ca 4x1

Layout
  SM3254 1066 v3 Xor 0186 64
Mix
  Input
    Order  0/2/1/3
  Block Pair
    Block  0x100000
    Page   0x1000
  Join by Page
    Parts  2
    Page   0x2000
  Join by Dump
    Parts  2
Assembler
  Block Number
    Block Size      0x400000
    Banks           0..31 / 0x000 / 0x0ff
    
    // Sector Updates
    Update Size     0x2000
    Update Enable   true
  Actions
    Scan
Comments
  Serg for forum 7757

Monolith Micro SD_1 45 4c a8 a2 1x1

Layout
  20-82-00511-1 14_2048_230 Xor C634_32I
Mix
  Input
    Order  0
  Block Pair
    Block  0x300000
    Page   0x2000
  Block Pair
    Block  0x600000
    Page   0x4000
  Divide
    Field  Block Number
    Value  0x3
  Divide
    Field  Block Rotate
    Value  0x40
  Block Rotate
    Block  0x400000
    Page   0x8000
Assembler
  Block Number
    Block Size   0xc00000
    Bank Space   0x4000
    Banks        00 / 0x000 / 0x5a5
  Actions
    Scan
Comments
  Serg for forum 9438
  Raw Recovery 80% good

Monolith Micro SD_1 98 de 98 92 1x4

Layout
  PS2251 1138_1132 v3
Mix
  Input
    Order  0/1/2/3
  Cut Bad Bytes
  Xor 5061
    Block     0x204000
    Page      0x2000
    Module    256
    BP Trash  true
  Block Pair
    Block  0x204000
    Page   0x2000
  Block Cut
    Block  0x400000/0x8000
  Join by Dump
    Parts  4
Assembler
  Block Number
    Block Size      0x400000
    Bank Space      0x2000
    Banks           00 / 0x000 / 0x1fff
  Actions
    Scan
Comments
  by Arvika
  No MBR, FAT, run RAW recovery
  ~97% recovered

Monolith Micro SD_1 98 3a 95 93 1x4

Layout
  PS2251 1106_1100 v3 Xor 0561_256
Mix
  Input
    Order  0/1/2/3
  Block Pair
    Block  0x400000
    Page   0x4000
  Join by Page
    Parts  2
    Page   0x8000
  Join by Dump
    Parts  2
Assembler
  Block Number
    Block Size      0x1000000
    Bank Space      0x800
    Banks           00 / 0x000 / 0x7ff
                    01 / 0x000 / 0x7ff
  Actions
    Scan
Comments
  by Arvika
  RAW recovery
  not sure with Bank space and banks size

Monolith Micro SD_1 98 3a 95 93 2x2

Layout
  PS8210 1106_1102 Xor 0561_256 v2
Mix
  Input
    Order  0/2/1/3
  Join by Page
    Parts  2
    Page   0x200
  Block Pair
    Block  0x800000
    Page   0x8000
  Join by Page
    Parts  2
    Page   0x10000
Assembler
  Block Number
    Block Size   0x2000000
    Bank Space   0x400
  Actions
    Scan
    Find Bank Size
Comments
  by Arvika
  Root corrupted, RAW scan give 98% good result

Monolith Micro SD_1 98 3a 98 a3 1x1

Sector 1146, May be 1038/108

Xor 55 AA FF 00 + base pattern
Depends from block number
Block number also xored

Was able to clean some sectors from xor
But unable to understand ECC code
Length of code is not common

Monolith Micro SD_1 98 3a 98 a3 1x2

Layout
  SD_20 v2 1148_1142
Mix
  Input
    Order  0/1
  Xor 5061
    Block     0x600000
    Page      0x4000
    Module    256
    BP Trash  false
  Block Pair
    Block  0x600000
    Page   0x4000
  Join by Dump
    Parts  2
Assembler
  Block Number
    Block Size      0xc00000
    Bank Space      0x4000
    Banks           00 / 0x000 / 0xb49
  Actions
    Scan
Comments
  Serg for forum 9047
  Raw Recovery

Monolith Micro SD_1 98 3a 98 a3 1x4

Can not be recovered

sector 1024*4 + 468 = 4564

4564 * 4 = 18256

SA = 10
ECC = 468 - 10 = 458

There is no ECC code with this size

At 77 dump i see that sectors with same data
had different parts of ECC. 31, 32, 8 bytes

Xor is same in different dumps
But is different in different blocks
May be can be calculated

Monolith Micro SD_1 98 3a 99 92 1x2

Layout
  PS2251 1138_1132 v3
Mix
  Input
    Order  0/1
  Cut Bad Bytes
  Xor 5061
    Block     0x204000
    Page      0x2000
    Module    256
    BP Trash  true
  Block Pair
    Block  0x204000
    Page   0x2000
  Join by Dump
    Parts  2
  Block Cut
    Block  0x400000/0x8000
Assembler
  Block Number
    Block Size      0x400000
    Bank Space      0x800
    
    Banks           00 / 0x000 / 0x74c
                    01 / 0x000 / 0x75d
                    02 / 0x000 / 0x75d
                    03 / 0x000 / 0x7ff
  Actions
    Scan
Comments
  Serg for forum 9235
  FAT was absent
  Raw Recovery 80% good

Monolith Micro SD_1 98 3c 99 a3 1x4

Layout
  SD_20 v2 1148_1142
Mix
  Input
    Order  0/2/1/3
  Xor 5061
    Block     0x600000
    Page      0x4000
    Module    256
    BP Trash  false
  Join by Page
    Parts  4
    Page   0x4000
  Cross Bank
    Block  0x1800000
    Bank   0x5a6
Assembler
  Block Number
    Block Size      0x1800000
    Bank Space      0x5a6
    Banks           0..3 / 0x000 / 0x5a6
  Actions
    Scan
Comments
  Serg for forum 10410
  Only Raw Recovery possible

Monolith Micro SD_1 98 3c 99 a3 4x1

Can not crack ECC

Sector  (1024/1024/1024/1024/468)*4/64

Monolith Micro SD_1 98 d3 84 32 1x1

Layout
  SD_20 1074_1070 Xor C5F6_128
Mix
  Input
    Order  0
  Block Rotate
    Block  0x100000
    Page   0x2000
Assembler
  Block Number
    Block Size      0x100000
    Bank Space      0x4000
    Image Cut       0xc00000/(0x4000/0x2000/(0x2000/0x2000)*61/0x2000/0x4000)*8
    Banks           00 / 0x000 / 0x3ff
  Actions
    Scan
Comments
  Serg for forum 10866

Monolith Micro SD_1 98 d5 84 32 1x1

Layout
  SD_20 v2 1109_1103 Xor 0561_128
Mix
  Input
    Order  0
  Block Rotate
    Block  0x100000
    Page   0x2000
Assembler
  Block Number
    Block Size      0x100000
    Bank Space      0x4000
    Image Cut       0/(0x4000/0x2000/(0x2000/0x2000)*61/0x2000/0x4000)*32
    Banks           00 / 0x000 / 0x7ff
  Actions
    Scan
Comments
  Serg for forum 7756

Monolith Micro SD_1 98 d5 86 a5 1x1

Layout
  SD_21 532_512_4
Mix
  Input
    Order  0
  Block Rotate
    Block  0x40000
    Page   0x800
Assembler
  Block Number
    Block Size      0x40000
    Bank Space      0x4000
    Banks           00 / 0x000 / 0x1fff
  Actions
    Scan
Comments
  Serg for forum 7298
  FAT is not build good
  Save image
  Use any recovery software

Monolith Micro SD_1 98 d5 94 32 1x1

Layout
  SD_20 1074_1070 Xor 6771_128
Mix
  Input
    Order  0
  Block Rotate
    Block  0x100000
    Page   0x2000
  Cross Bank
    Block  0x100000
    Bank   0x400
Assembler
  Block Number
    Block Size      0x100000
    Bank Space      0x400
    Image Cut       0x3200000
  Actions
    Scan
    Find Bank Size
Comments
  by Vlad forum 5053
  looks like 3 more banks of card were not read
  part of data were out of image

Monolith Micro SD_1 98 d5 94 32 1x1 v2

Layout
  SD_20 1074_1070 Xor C5F6_128
Mix
  Input
    Order  0
  Block Pair
    Block  0x100000
    Page   0x2000
  Block Rotate
    Block  0x200000
    Page   0x2000
Assembler
  Block Number
    Block Size      0x200000
    Bank Space      0x400
    Image Cut       0x1800000/(0x8000/0x4000/(0x4000/0x4000)*61/0x4000/0x8000)*2
    
    Banks           00 / 0x000 / 0x3c0
    
    // Sector Updates
    Update Size     0x2000
    Update Enable   true
  Actions
    Scan
Comments
  Serg for forum 6019

Monolith Micro SD_1 98 d5 95 ba 1x1

Layout
  PS8000 538
Mix
  Input
    Order  0
  Block Rotate
    Block  0x80000
    Page   0x2000
Assembler
  Block Number
    Block Size   0x80000
    Bank Space   0x800
    Image Cut    0x1600000
    
    Banks        00 / 0x000 / 0x7af
                 01 / 0x000 / 0x7af
  Actions
    Scan
Comments
  Serg for forum 6021

Monolith Micro SD_1 98 d5 98 b2 1x1

Layout
  SD_20 1074_1070 Xor C5F6_128
Mix
  Input
    Order  0
  Block Pair
    Block  0x180000
    Page   0x2000
  Block Rotate
    Block  0x300000
    Page   0x2000
Assembler
  Block Number
    Block Size      0x300000
    Bank Space      0x400
    Image Cut       0x3000000/(0x4000/0x4000/(0x4000/0x8000)*63/0/0x4000)*8
    Banks           00 / 0x000 / 0x2bd
  Actions
    Scan
Comments
  Serg for forum 7637
  Rotate is OK
  But some dirs still shifted 
  Shift is more then block size

Monolith Micro SD_1 98 d5 98 b2 1x1 v2

Layout
  SD_20 1074_1070 Xor C5F6_128
Mix
  Input
    Order  0
  Block Pair
    Block  0x180000
    Page   0x2000
  Block Rotate
    Block  0x300000
    Page   0x2000
Assembler
  Block Number
    Block Size      0x300000
    Bank Space      0x4000
    Image Cut       0x2400000/(0x4000/0x4000/(0x4000/0x8000)*62/0x4000/0xc000)*4
    Banks           00 / 0x000 / 0x287
  Actions
    Scan
Comments
  Serg for forum 8633
  Rotate is OK
  But some dirs still shifted 
  Shift is more then block size

Monolith Micro SD_1 98 d5 98 b2 2x1

Layout
  SD_20 1074_1070 Xor C5F6_128
Mix
  Input
    Order  0/1
  Block Pair
    Block  0x180000
    Page   0x2000
  Block Rotate
    Block  0x300000
    Page   0x2000
  Join by Dump
    Parts  2
Assembler
  Block Number
    Block Size      0x300000
    Bank Space      0x2be
    Image Cut       0x3000000/(0x4000/0x4000/(0x4000/0x8000)*63/0/0x4000)*8
    
    Banks           00 / 0x000 / 0x287
                    01 / 0x000 / 0x287
  Actions
    Scan
Comments
  Serg for forum 8573
  There is strange shifts in check dirs
  But may be 70% of file tree is OK

Monolith Micro SD_1 98 d7 94 32 1x2

Layout
  SD_20 v2 1109_1103 Xor 0561_128
Mix
  Input
    Order  0/1
  Block Pair
    Block  0x100000
    Page   0x2000
  Block Rotate
    Block  0x200000
    Page   0x2000
  Join by Dump
    Parts  2
Assembler
  Block Number
    Block Size      0x200000
    Bank Space      0x800
    Image Cut       0/(0x8000/0x4000/(0x4000/0x4000)*61/0x4000/0x8000)*40
    
    Banks           00 / 0x000 / 0x76c
                    01 / 0x000 / 0x7ff
  Actions
    Scan
Comments
  Serg for forum 10755

Monolith Micro SD_1 98 d7 94 32 2x1

Layout
  SD_20 v2 1109_1103 Xor 0561_128
Mix
  Input
    Order  0/1
  Block Pair
    Block  0x100000
    Page   0x2000
  Join by Page
    Parts  2
    Page   0x4000
  Divide
    Field  Block Rotate
    Value  0x10
  Block Rotate
    Block  0x400000
    Page   0x2000
Assembler
  Block Number
    Block Size      0x400000
    Bank Space      0x4000
    Image Cut       0x3800000/(0x10000/0x8000/(0x8000/0x8000)*30/0/0x208000)*8  
  
    Banks           00 / 0x000 / 0x7ff
  Actions
    Scan
Comments
  Serg for forum 7816

Monolith Micro SD_1 98 d7 96 ba 1x1

Layout
  SD_21 534_542
Mix
  Input
    Order  0
  Block Rotate
    Block  0x80000
    Page   0x1000
Assembler
  Block Number
    Block Size      0x80000
    Bank Space      0x4000
    Banks           00 / 0x000 / 0x1fff
  Actions
    Scan
Comments
  Serg for forum 9086

Monolith Micro SD_1 98 d7 98 92 1x1

Layout
  PS2251 1138_1132 v3
Mix
  Input
    Order  0
  Cut Bad Bytes
  Xor 5061
    Block     0x204000
    Page      0x2000
    Module    256
    BP Trash  true
  Block Pair
    Block  0x204000
    Page   0x2000
  Block Cut
    Block  0x400000/0x8000
Assembler
  Block Number
    Block Size      0x400000
    Bank Space      0x4000
    Banks           00 / 0x000 / 0x3ff
  Actions
    Scan
Comments
  Serg for forum 7855
  Model created using LBA pattern dump
  First blocks was absent
  Also they was absent in 77 dumps
  In customer daata dumps i do not found MBR and FAT tables
  Also i see on LBA dumps that need make Image Cut 0x1800000,
  that LBA numbers was correctly matched

Monolith Micro SD_1 98 d7 99 b2 1x2

Layout
  SD_20 1074_1070 Xor C5F6_128
Mix
  Input
    Order  0/1
  Block Pair
    Block  0x180000
    Page   0x2000
  Block Rotate
    Block  0x300000
    Page   0x2000
  Join by Dump
    Parts  2
Assembler
  Block Number
    Block Size      0x300000
    Bank Space      0x2be
    Image Cut       0x3c00000/(0x4000/0x4000/(0x4000/0x8000)*62/0x4000/0xc000)*2
0
    
    Banks           00 / 0x000 / 0x287
                    01 / 0x000 / 0x287
                    02 / 0x000 / 0x287
                    03 / 0x000 / 0x287
  Actions
    Scan
Comments
  Serg for forum 10859
  Block Rotate in some blocks works wrong
  Many broken photos
  Can try save image and use JPEG_Scanner
  with block size 0x100000

Monolith Micro SD_1 98 de 84 93 1x1

Layout
  SD_20 v2 1108_1102 Xor 0561_256
Mix
  Input
    Order  0
Assembler
  Block Number
    Block Size      0x400000
    Bank Space      0x4000
    Image Cut       0x1000000
    Banks           00 / 0x000 / 0x7ff
  Actions
    Scan
Comments
  by Arvika
  Image Cut can be done, but RAW recovery give good result

Monolith Micro SD_1 98 de 98 92 1x1

Layout
  PS2251 1138_1132 v3
Mix
  Input
    Order  0
  Cut Bad Bytes
  Xor 5061
    Block     0x204000
    Page      0x2000
    Module    256
    BP Trash  true
  Block Pair
    Block  0x204000
    Page   0x2000
  Block Cut
    Block  0x400000/0x8000
Assembler
  Block Number
    Block Size      0x400000
    Bank Space      0x2000
    Banks           00 / 0x000 / 0x7ff
  Actions
    Scan
Comments
  Serg for forum 7897
  First block absent
  Use Raw Recovery
  
  27.03.2017 Block_Cut added

Monolith Micro SD_1 98 de 98 92 1x1 v2

Sector 1146
Data 1030
SA 116

After remove part of xor
Can see mask 00 ff 55 aa

I remove xor
But can not find ECC

Some results i save at
Layout\Lib\Unknown 1146

Monolith Micro SD_1 98 de 98 92 1x2

Layout
  PS2251 1138_1132 v3
Mix
  Input
    Order  0/1
  Cut Bad Bytes
  Xor 5061
    Block     0x204000
    Page      0x2000
    Module    256
    BP Trash  true
  Block Pair
    Block  0x204000
    Page   0x2000
  Block Cut
    Block   0x400000/0x8000
  Join by Dump
    Parts  2
Assembler
  Block Number
    Block Size      0x400000
    Bank Space      0x800
    Banks           00 / 0x000 / 0x751
                    01 / 0x000 / 0x7ff
  Actions
    Scan
Comments
  by Arvika
  No MBR, FAT, save image and run RAW recovery
  ~95% data recovered ok
  
  Bank Space fixed by Serg 3.3.2020

Monolith Micro SD_1 98 de 98 92 1x2 Crypted

Crypted or XOR depends from block number

At dumps writed with 77 pattern i see:
1. XOR is different at each next block
2. XOR is different at different memory banks
3. I dont see SA in dumps

Monolith Micro SD_1 98 de 98 92 1x2 v2

Layout
  PS2251 1152_1146 v3
Mix
  Input
    Order  0/1
  Cut Bad Bytes
  Join by Dump
    Parts  2
  Xor 5061
    Block     0x204000
    Page      0x2000
    Module    256
    BP Trash  true
  Block Pair
    Block  0x204000
    Page   0x2000
  Block Cut
    Block  0x400000/0x8000
Assembler
  Block Number
    Block Size      0x400000
    Bank Space      0x4000
    Banks           00 / 0x000 / 0xfff
  Actions
    Scan
Comments
  Serg for forum 10585

Monolith Micro SD_1 98 de 98 92 1x4 v2

Layout
  PS2251 1152_1146 v3
Mix
  Input
    Order  0/1/2/3
  Xor 5061
    Block     0x204000
    Page      0x2000
    Module    256
    BP Trash  true
  Block Pair
    Block  0x204000
    Page   0x2000
  Block Cut
    Block  0x400000/0x8000
  Join by Dump
    Parts  4
Assembler
  Block Number
    Block Size      0x400000
    Bank Space      0x2000
    Banks           00 / 0x000 / 0x1fff
  Actions
    Scan
Comments
  by Arvika
  BB was cut manually in this case
  dump order could be other
  RAW recovery ok

Monolith Micro SD_1 98 de 98 92 2x1

Layout
  PS8035 1138_1132
Mix
  Input
    Order  0/1
  Cut Bad Bytes
  Xor 5061
    Block     0x204000
    Page      0x2000
    Module    256
    BP Trash  true
  Block Pair
    Block  0x204000
    Page   0x2000
  Join by Dump
    Parts  2
  Block Cut
    Block  0x400000/0x8000
Assembler
  Block Number
    Block Size      0x400000
    Bank Space      0x800
    Banks           00 / 0x000 / 0x7ff
                    01 / 0x000 / 0x7ff
  Actions
    Scan
Comments
  Serg for forum 8683
  Need correct bank sizes

Monolith Micro SD_1 ad 3a 18 03 1x1

Layout
  SD_20 v2 1148_1142
Mix
  Input
    Order  0
  Xor 5061
    Block     0x600000
    Page      0x4000
    Module    256
    BP Trash  false
  Block Pair
    Block  0x600000
    Page   0x4000
Assembler
  Block Number
    Block Size      0xc00000
    Bank Space      0x4000
    Banks           00 / 0x000 / 0x4ff
  Actions
    Scan
Comments
  By Arvika

上一篇： Monolith MS 2
下一篇：Micro SD Part 2

站内搜索

联系我们