Micro SD Part 3-2Flash Extractor-芯片级数据恢复取证方案025-83608636

Micro SD Part 3-2

Monolith Micro SD_27 45 3c 98 b3 1x2

Layout
  Unknown 40_1130 Xor 006f_256
Mix
  Input
    Order 0/1
  Join by Dump
    Parts 2
Assembler
  Sector Number Slow
    Sector Size 0x4000
Comments
  Serg for forum 11675

Monolith Micro SD_28 98 3a 98 a3 2x1

Layout
  Unknown 1138_1134 Xor 5061_256
Mix
  Input
    Order 0/1
  Join by Dump
    Parts 2
Assembler
  Sector Number Slow
    Sector Size 0x1000
Comments
  Serg for forum 11500

  File tree wrong

  Raw Recovery:
  2757 good jpegs, broken 3990

  Layout and model was changed to sector size 0x1000
  Need verify again

Monolith Micro SD_29 98 3c 98 b3 1x4

Can not recover

LDPC

77 pattern have repeats and zeros in ECC

Sector: 2280

8_2048_8_216

Monolith Micro SD_30 98 3e 98 b3 1x1

Layout
  SM 1144_31 Xor dd SA
Mix
  Input
    Order 0
  Block Cut
    Block 0x1200000/0x1E00000
Assembler
  Block Number
    Block Size   0x1200000
    Banks        0..5 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  Serg for forum 11678

Monolith Micro SD_31 45 3c 98 b3 1x2

Layout
  PS 1146 Xor 5061_256
Mix
  Input
    Order 0/1
  Join by Page
    Parts 2
    Page   0x4000
  Block Pair
    Block 0x1800000
    Page   0x4000
  Cut Bits
    Field Sector Number
    Mask   0x80
Assembler
  Sector Number Slow
    Sector Size 0x8000
Comments
  JeremyB
  90% Perfect Recovery

Monolith Micro SD_32 98 d7 94 32 1x2

Layout
  SD_20 v2 1109_1103 Xor 0561_128
Mix
  Input
    Order 0/1
  Block Pair
    Block 0x100000
    Page   0x2000
  Join by Page
    Parts 2
    Page   0x4000
Assembler
  Block Number
    Block Size      0x400000
    Bank Space      0x4000
    Banks           00 / 0x000 / 0x7ff
  Actions
    Scan
Comments
  Serg for forum 11786
  Only 50% good jpegs with Raw Recovery

Monolith Micro SD_33 98 3c 98 b3 1x1

Unrecoverable

I think this card use LDPC ECC

When 3 bytes changed in sector,
only some lines changes in ECC,
but rest 80% keep same

Sector 4096_472 = 4568

Xor 00 b1 bd

Monolith Micro SD_34 98 3a 98 a3 1x2

Layout
  SSS Renum 1140 Xor 7F61_384
Mix
  Input
    Order 0/1
  Block Renum
    Block 0x600000
    Page   0x4000
  Block Pair
    Block 0x600000
    Page   0x4000
  Join by Dump
    Parts 2
Assembler
  Block Number
    Block Size   0xc00000
    Banks        00 / 0x000 / 0xb49
  Actions
    Scan
Comments
  Serg for forum 11828

  MBR, FAT32 was missing

Monolith Micro SD_35 98 3a 98 a3 1x1

Layout
  PS 1146 Xor 5061_256
Mix
  Input
    Order 0
  Block Pair
    Block 0x600000
    Page   0x4000
  Cut Bits
    Field Sector Number
    Mask   0x80
Assembler
  Sector Number Slow
    Sector Size 0x8000
Comments
  by Arvika

Monolith Micro SD_36 ec de 98 ce 1x4

Layout
  Unknown 44_1144 Xor BN ff_00
Mix
  Input
    Order 1/0/3/2
  Block Pair
    Block 0x180000
    Page   0x2000
  Join by Dump
    Parts 4
Assembler
  Sector Number
    Block Size     0x300000
    Sector Size    0x4000
    Sectors        0x300
    Block Numbers true
  Actions
    Scan
Comments
  by Bolo
  Perfect recovery
  1) Use layout SM3281 32_1144 for ECC fix and Reread for odd blocks
  2) Use layout Unknown 44_1144 Xor BN ff_00 for ECC fix and Reread for even blo
cks
  3) After fix prepare image - Odd blocks don't have SA and ECC (44b) and got ad
ditional 32b
    Need to remove 32b and copy SA with ECC from even blocks, after this save du
mps and use model
  Notes: dump order can be diffrent

Monolith Micro SD_37 45 4c 98 a3 1x1

Layout
  Unknown f1 1138 Xor 6771_384_128 BP
Mix
  Input
    Order 0
  Software Bad Bytes
    Block 384
    Group 2
  Block Pair
    Block 0x600000
    Page   0x4000
Assembler
  Sector Number Slow
    Sector Size     0x10000
Comments
  Serg for forum 12001

Monolith Micro SD_38 45 de a8 92 1x1

Layout
  20-82-00511-1 14_2048_230 Xor C634_32I_WL
Mix
  Input
    Order 0
  Block Pair
    Block 0x204000
    Page   0x2000
  Divide
    Field Block Number
    Value 0x3
  Block Cut
    Block 0x400000/0x8000
  Divide
    Field Block Rotate
    Value 0x20
  Block Rotate
    Block (0x158000)*2/0x150000
    Page   0x4000
Assembler
  Block Number
    Block Size   0x400000
    Bank Space   0x4000
    Banks        00 / 0x000 / 0x7ff
  Actions
    Scan
Comments
  Serg for forum 12034

  Many broken files

  Jpegs: good 793, bad 306

Monolith Micro SD_39 ad 5c 14 63 1x1

Layout
  PS 1126_2 Xor 5061_256
Mix
  Input
    Order 0
  Block Pair
    Block 0x1300000
    Page   0x4000
  Cut Bits
    Field Sector Number
    Mask   0x80
  Cut Bits
    Field Sector Number
    Mask   0x2000
Assembler
  Sector Number Slow
    Sector Size     0x10000
Comments
  Serg for forum 12062

  2216 good vs 1474 broken jpegs

Monolith Micro SD_40 45 3e 98 b3 1x1

Layout
  SM 1144_31 Xor dd SA
Mix
  Input
    Order 0
  Block Pair
    Block 0x1800000
    Page   0x4000
  Block Cut
    Block 0x2400000/0xC00000
Assembler
  Block Number
    Block Size   0x2400000
    Banks        00..07 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  by Serg & Bolo

Monolith Micro SD_41 98 d7 94 32 2x2

Layout
  SD_20 v2 1109_1103 Xor 0561_128
Mix
  Input
    Order 0/2/1/3
  Join by Page
    Parts 2
    Page   0x200
  Block Pair
    Block 0x200000
    Page   0x4000
  Join by Dump
    Parts 2
Assembler
  Block Number
    Block Size      0x400000
    Bank Space      0x800
    Image Cut       0x5008000
    Banks           00..01 / 0x000 / 0x7a7
  Actions
    Scan
Comments
  by Arvika
  RAW recovery gives 50% good jpg
  After carving I get 80% good jpg

Monolith Micro SD_42 45 3c 98 b3 1x1

Layout
  SM 1144_31 Xor dd SA
Mix
  Input
    Order 0
  Block Pair
    Block 0xc00000
    Page   0x4000
Assembler
  Block Number
    Block Size   0x1800000
    Banks        00..04 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  by Arvika
  ID: 45 3c 98 b3 76 72

Monolith Micro SD_43 ec de 88 bf 2x8

Layout
  SM2702_40 1150_31 Xor dd SA
Mix
  Input
    Order 0/8/1/9/4/12/5/13/6/14/7/15/2/10/3/11
  Join by Byte
    Parts 2
    Data   true
  Join by Page
    Parts 2
    Page   0x8000
  Join by Dump
    Parts 4
Assembler
  Block Number
    Block Size   0x1000000
    Banks        00 / 0x000 / 0x1fff
  Actions
    Scan
Comments
  Serg for forum 12132
  For LBA pattern

Monolith Micro SD_44 ec de 94 43 1x1 Ref

Layout
  SM3259 1118_31 Xor I 5a09_256 SA
Mix
  Input
    Order 0
  Block Cut
    Block 0/0x4000/0x4AC000
Assembler
  Block Number
    Block Size      0x4ac000
    Banks           0..7 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  Serg for forum 12197

Monolith Micro SD_45 ec d5 94 29 1x1

Layout
  SM3254 528
Mix
  Input
    Order 0
  Block Pair
    Block 0x80000
    Page   0x1000
Assembler
  Block Number
    Block Size   0x100000
    Bank Space   0x400
  Actions
    Scan
    Find Bank Size
Comments
by Bolo
Perfect Recovery !

Monolith Micro SD_46 98 3c 98 b3 1x1

Layout
  PS 1126_2 Xor 5061_256
Mix
  Input
    Order 0
  Software Bad Bytes
    Block 768
    Group 2
  Block Pair
    Block 0xc00000
    Page   0x4000
  Cut Bits
    Field Sector Number
    Mask   0x80
Assembler
  Sector Number Slow
    Sector Size     0x8000
  Actions
    Scan
Comments
  by Arvika
  ID: 98 3c 98 b3 76 72
  Correct layout should be 1126_4
  SBB cut software bad bytes + 2 last bytes of sector so layout 1126_2 fit
  SBB: Auto 2 same pairs + manual adjust

Monolith Micro SD_47 45 3e 98 b3 1x1

Layout
  PS 1146 Xor 5061_384_256
Mix
  Input
    Order 0
  Cut Bits
    Field Sector Number
    Mask   0x2080
Assembler
  Sector Number Slow
    Sector Size     0x4000
Comments
  by Arvika
  ID: 45 3e 98 b3 76 6b
  First calculate ECC=on
  Second, scan and save image with ECC=check

Monolith Micro SD_48 2c 2c d3 1c 1x1

Layout
  SM 1150_32_32 Xor 17fe_1024 SA
Mix
  Input
    Order 0/1
  Join by Dump
    Parts 2
Assembler
  Sector Number Slow
    Sector Size     0x1000
Comments
  Serg for forum 12222

  98.5% successful recovery

  Config / Cmd = 05_E0

  Dump read by Jeremy
  WE, RE, Vcc and VccQ are 1.2v
  Only after several attemps he can get correct dump
  Before it have empty and repeated pages in block

  He made his own power adapter
  And play with Voltages

  Used 0.7v low and 1.5v high

  Read more info in case topic

Monolith Micro SD_49 ad 5c 28 ba 1x1

Layout
  PS 1150_2 Xor 5061_256
Mix
  Input
    Order 0
  Block Pair
    Block 0x900000
    Page   0x2000
  Block Pair
    Block 0x1200000
    Page   0x4000
  Cut Bits
    Field Sector Number
    Mask   0x3080ff
Assembler
  Sector Number Slow
    Sector Size     0x8000
Comments
  by Arvika
  Fix ECC=on
  Scan with ECC=check
  Save with ECC=off
  MBR at offset 0x400000

Monolith Micro SD_50 98 d7 84 93 1x1

Layout
  PS8210 1106_1102 Xor 0561_256 v2
Mix
  Input
    Order 0
Assembler
  Block Number
    Block Size   0x400000
    Bank Space   0x4000
    Banks        00 / 0x000 / 0x3ff
  Actions
    Scan
Comments
  by Arvika

Monolith Micro SD_50 ec 1c 98 3f 1x1

Unrecoverable

Sector 36_2048_224 = 36_2272 = 2308

Xor = ff 00 grid

ECC is not BCH
May be LDPC, may be not
Many zeros in ECC in LDPC pattern

Monolith Micro SD_51 45 3e 97 93 1x1

Layout
  20-82-00515-5 14_2048_146 Xor C634 16_2
Mix
  Input
    Order 0
Assembler
  Sector Number Slow
    Sector Size     0x1000
Comments
  by Arvika
  ID: 45 3e 97 93 7e 51
  Fix ECC=on
  Scan with ECC=Check
  RAW recovery

Monolith Micro SD_52 98 3a 98 a3 1x1

Layout
  Unknown 1138_1134 Xor 5061_256
Mix
  Input
    Order 0
Assembler
  Sector Number Slow
    Sector Size     0x1000
Comments
  Serg for forum 12458

Monolith_MicroSD_7 ad d5 94 25 1x1

Layout
  PS8000 538
Mix
  Input
    Order 0
  Block Pair
    Block 0x80000
    Page   0x1000
  Block Rotate
    Block 0x100000
    Page   0x2000
Assembler
  Block Number
    Block Size   0x100000
    Bank Space   0x800
    Image Cut    0x1600000
    Banks        00 / 0x000 / 0x78b
  Actions
    Scan
Comments
  By Arvika

上一篇： Micro SD Part 3-1
下一篇： Micro SD Part 4

站内搜索

联系我们