SD Part 2Flash Extractor-芯片级数据恢复取证方案025-83608636

SD Part 2

Monolith SD 11 ad d7 94 da 2x2

Layout
  SM3257 1100_31 Xor b36e_128
Mix
  Input
    Order  0/2/1/3
  Join by Byte
    Parts  2
    Data   true
  Join by Page
    Parts  2
    Page   0x4000
  Block Pair
    Block  0x800000
    Page   0x4000
Assembler
  Block Number
    Block Size   0x1000000
    Banks           00 / 0x000 / 0x0ff
                    01 / 0x000 / 0x0ff
                    02 / 0x000 / 0x0ff
                    03 / 0x000 / 0x0be   
    Update Size     0x8000
    Update Enable   true
  Actions
    Scan
Comments
    By JeremyB @ RecoverMyFlashDrive.com

Monolith SD_6 98 3a 98 a3 1x2

Layout
  SD_20 v2 1148_1142
Mix
  Input
    Order  0/1
  Xor 5061
    Block     0x600000
    Page      0x4000
    Module    256
    BP Trash  false
  Block Pair
    Block  0x600000
    Page   0x4000
  Join by Dump
    Parts  2
Assembler
  Block Number
    Block Size      0xc00000
    Bank Space      0x4000
    Banks           00 / 0x000 / 0x9ff
  Actions
    Scan
Comments
  by Arvika
  RAW recovery
  check and verify "Banks" size

Monolith SD_6 98 3c 98 b3 1x1

Problem with ECC

Sector 4096_472 = 4568 

Xor 00 b1 bd 

This controller have nonstandard ECC algo 
When 3 bytes changed in sector only some
lines changes in ECC, but rest 80% keep same

Monolith SD_6 98 d5 94 32 1x1

Layout
  SD_20 1074_1070 Xor C5F6_128
Mix
  Input
    Order  0
  Block Pair
    Block  0x100000
    Page   0x2000
  Block Rotate
    Block  0x200000
    Page   0x2000
Assembler
  Block Number
    Block Size      0x200000
    Bank Space      0x400
  Actions
    Scan
    Find Bank Size
Comments
  by Arvika
  Root is ereased, run RAW recovery.

Monolith SD_6 98 de 88 a3 1x1

Layout
  SD_20 v2 1148_1142
Mix
  Input
    Order  0
  Xor 5061
    Block     0x200000
    Page      0x4000
    Module    256
    BP Trash  false
Assembler
  Block Number
    Block Size      0x200000
    Bank Space      0x4000
    Banks           00 / 0x000 / 0x10bb
  Actions
    Scan
Comments
  Serg for forum 10253
  With Raw Recovery and Xor Block
  i get next number of good jpegs
  600000 88
  200000 91
  100000 0
  But result is not perfect
  
  8.9.2019: LBA Pattern confirm model
  Can add Image Cut 0x2400000

Monolith SD_6 98 de 94 82 1x2

Layout
  SD_20 v2 1109_1103 Xor 0561_256
Mix
  Input
    Order  0/1
  Block Pair
    Block  0x200000
    Page   0x2000
  Divide
    Field  Block Rotate
    Value  0x10
  Block Rotate
    Block  0x400000
    Page   0x2000
  Join by Dump
    Parts  2
Assembler
  Block Number
    Block Size      0x400000
    Bank Space      0x800
    Image Cut       0x4800000/(0x10000/0x8000/(0x8000/0x8000)*30/0/0x208000)*8
    
    Banks           00 / 0x000 / 0x7a7
                    01 / 0x000 / 0x7a7
  Actions
    Scan
Comments
  Serg for forum 10483

Monolith SD_7 ec 3a e5 7a 1x2

Layout
  SM3257 1100_31 Xor f600_128 SA
Mix
  Input
    Order  0/1
  Block Pair
    Block  0x100000
    Page   0x2000
  Block Pair
    Block  0x200000
    Page   0x4000
  Join by Page
    Parts  2
    Page   0x8000
Assembler
  Block Number
    Block Size      0x800000
    Banks           00..15 / 0x000 / 0x0ff
  Actions
    Scan
Comments
    By Arvika

Monolith SD_7 ec de 98 ce 1x1

Layout
  SM2702 1148_31 Xor dd SA Swap
Mix
  Input
    Order  0
  Block Pair
    Block  0x180000
    Page   0x2000
Assembler
  Block Number
    Block Size      0x300000
    Banks           00 / 0x000 / 0xaaa
  Actions
    Scan
Comments
  Serg for forum 10310

Monolith SD_7 ec de 98 ce 1x2

Layout
  Unknown 44_1144 Xor BN ff_00
Mix
  Input
    Order  0/1
  Block Pair
    Block  0x180000
    Page   0x2000
  Join by Dump
    Parts  2
Assembler
  Sector Number
    Block Size     0x300000
    Sector Size    0x4000
    Sectors        0x300
    Block Numbers  true
  Actions
    Scan
Comments
  Serg for forum 10518
  95% good photos with Raw Recovery
  Odd blocks do not have SA
  Need copy SA from even blocks
  This must be done before using FE

Monolith SD_8 98 de 84 93 1x2

Layout
  SD_20 v2 1108_1102 Xor 0561_256
Mix
  Input
    Order  0/1
  Join by Dump
    Parts  2
Assembler
  Block Number
    Block Size      0x400000
    Bank Space      0x800
    Image Cut       0x1000000/(0x8000/0x4000/(0x4000/0x4000)*62/0x208000/0x80800
0)*3
    Banks           00 / 0x000 / 0x7ff
                    01 / 0x000 / 0x7ff
  Actions
    Scan
Comments
  by Arvika
  FAT32 little coruption, manual correction
  
  My version of Image Cut
  (0/0x8000/0x4000/(0x4000/0x4000)*62/0/0x204000/0)*8/0x2000000
  Serg

Monolith SD_9 98 3a 98 a3 2x1

Layout
  SD_20 v2 1148_1142
Mix
  Input
    Order  0/1
  Xor 5061
    Block     0x600000
    Page      0x4000
    Module    256
    BP Trash  false
  Block Pair
    Block  0x600000
    Page   0x4000
  Join by Dump
    Parts  2
Assembler
  Block Number
    Block Size      0xc00000
    Bank Space      0x4000
    Banks           00 / 0x000 / 0xb49
  Actions
    Scan
Comments
  Serg for forum 8995
  Raw Recovery

Monolith SD_9 98 d7 94 32 1x1

Layout
  SD_20 1074_1070 Xor 6771_128
Mix
  Input
    Order  0
  Block Rotate
    Block  0x100000
    Page   0x2000
  Cross Bank
    Block  0x100000
    Bank   0x800
Assembler
  Block Number
    Block Size      0x100000
    Bank Space      0x800
    Image Cut       0x2200000
  Actions
    Scan
    Find Bank Size
Comments
  Serg for forum 9117

Monolith SD_10 ec d7 98 ce 1x1

Layout
  SM3257 1144_27 Xor b36e_256_v2
Mix
  Input
    Order  0
  Block Pair
    Block  0x180000
    Page   0x2000
Assembler
  Block Number
    Block Size      0x300000
    Banks           00 / 0x000 / 0x0ff
                    01 / 0x000 / 0x0ff
                    02 / 0x000 / 0x0ff
                    03 / 0x000 / 0x0ff
                    04 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  Serg for forum 6417

Monolith SD_11 ad de 94 d2 2x2

Layout
  SM2702 1075_31 Xor b36e_128
Mix
  Input
    Order  0/2/1/3
  Join by Byte
    Parts  2
    Data   true
  Block Pair
    Block  0x400000
    Page   0x4000
  Join by Page
    Parts  2
    Page   0x8000
Assembler
  Block Number
    Block Size      0x1000000
    Banks           0..7 / 0x000 / 0x0ff
    
    // Sector Updates
    Update Size     0x8000
    Update Enable   false
  Actions
    Scan
Comments
  Serg for forum 7512
  Updates is off in model, because Open Image works very slow
  You can set them on, to get little better result

Monolith SD_12 45 de 94 82 2x1

Layout
  EN2683 1094 Xor 0186 64
Mix
  Input
    Order  0/1
  Block Pair
    Block  0x200000
    Page   0x2000
  Join by Page
    Parts  2
    Page   0x4000
Assembler
  Block Number
    Block Size      0x800000
    Banks           00..07 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  by Arvika
  dump order can be other
  check conflicts

Monolith SD_13 2c 68 04 4a 4x1

Layout
  SM3257 1072_31 Xor b36e_128
Mix
  Input
    Order  0/2/1/3
  Join by Byte
    Parts  2
    Data   true
  Block Pair
    Block  0x200000
    Page   0x2000
  Join by Page
    Parts  2
    Page   0x4000
Assembler
  Block Number
    Block Size      0x800000
    Banks           0..7 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  Serg for forum 7544

Monolith SD_13 2c 88 04 4b 2x1

Layout
  SM2702 1075_31 Xor b36e_128
Mix
  Input
    Order  1/0
  Join by Byte
    Parts  2
    Data   true
  Block Pair
    Block  0x400000
    Page   0x4000
Assembler
  Block Number
    Block Size      0x800000
    Banks           00..07 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  by Arvika
  check conflicts
  if we set update size 0x8000 -> filesystem structure looks better, but data wo
rse

Monolith SD_14 ad d3 14 a5 2x1

Layout
  SM32xx 528 Bank Space U48
Mix
  Input
    Order  1/0
  Join by Byte
    Parts  2
    Data   false
  Block Pair
    Block  0x80000
    Page   0x1000
Assembler
  Block Number
    Block Size      0x100000
    Bank Space      0x400
    
    // Sector Updates
    Update Size     0x2000
    Update Enable   true
  Actions
    Scan
    Find Bank Size
Comments
  Serg for forum 7696

Monolith SD_15 ec d7 94 7a 2x1

Layout
  SK6617 1080_1076 Xor aaaad4d4_128
Mix
  Input
    Order  0/1
  Block Pair
    Block  0x100000
    Page   0x2000
  Join by Page
    Parts  2
    Page   0x4000
  Block Rotate
    Block  0x400000
    Page   0x8000
Assembler
  Block Number
    Block Size      0x400000
    Bank Space      0x200
  Actions
    Scan
    Find Bank Size
Comments
  Serg for forum 8166
  There is something wrong with banks
  But Raw Recovery give many good jpegs

Monolith SD_16 ec de 98 ce 2x2

Layout
  SM3257 1148_27 Xor b36e_256_SA
Mix
  Input
    Order  1/2/3/0
  Block Pair
    Block  0x180000
    Page   0x2000
  Join by Page
    Parts  2
    Page   0x4000
  Join by Dump
    Parts  2
Assembler
  Block Number
    Block Size      0x600000
    Banks           00..31 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  by Arvika
  dumps was read on other reader, dump order can be other
  few first blocks was ereased. RAW scan give 较高 good result

Monolith SD_17 98 3c 95 93 4x1

Layout
  PS8210 1106_1102 Xor 0561_256 v2
Mix
  Input
    Order  0/2/1/3
  Join by Page
    Parts  2
    Page   0x200
  Block Pair
    Block  0x800000
    Page   0x8000
  Join by Page
    Parts  2
    Page   0x10000
Assembler
  Block Number
    Block Size   0x2000000
    Bank Space   0x4000
    Banks        00 / 0x000 / 0xfff
  Actions
    Scan
Comments
  Serg for forum 8699
  Only Raw Recovery possible
  50% of photos was good

Monolith SD_17 98 3c 95 93 4x1 v2

Layout
  PS8210 1106_1102 Xor 0561_256 v2
Mix
  Input
    Order  0/1/2/3
  Join by Page
    Parts  2
    Page   0x200
  Block Pair
    Block  0x800000
    Page   0x8000
  Join by Page
    Parts  2
    Page   0x10000
Assembler
  Block Number
    Block Size   0x2000000
    Bank Space   0x800
    Image Cut    0/(0x40000/0x20000/(0x20000/0x20000)*0x1E/0/0x1820000)*10
  Actions
    Scan
    Find Bank Size
Comments
  by Serg
  Image Cut *10 can be different

Monolith SD_18 2c 64 44 4b 1x1

Layout
  SM2702 1112_31 Xor b36e_128_SA
Mix
  Input
    Order  0
  Block Pair
    Block  0x200000
    Page   0x2000
Assembler
  Block Number
    Block Size      0x400000
    Banks           0..7 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  Serg for forum 10515

Monolith SD_18 2c 64 44 4b 2x2

Layout
  SM2702 1112_31 Xor f602_128_SA
Mix
  Input
    Order  0/2/1/3
  Join by Byte
    Parts  2
    Data   true
  Block Pair
    Block  0x400000
    Page   0x4000
  Join by Page
    Parts  2
    Page   0x8000
Assembler
  Block Number
    Block Size      0x1000000
    Banks           00..07 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  by Arvika
  check conflicts
  dump order can be other

Monolith SD_18 2c 84 64 3c 2x2

Layout
  SM3257 1094_31 Xor b36e_128_SA
Mix
  Input
    Order  0/2/1/3
  Join by Byte
    Parts  2
    Data   true
  Block Pair
    Block  0x1000000
    Page   0x8000
  Join by Page
    Parts  2
    Page   0x10000
Assembler
  Block Number
    Block Size      0x4000000
    Banks           00..03 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  by Arvika
  dump order can be other

Monolith SD_18 2c 84 64 54 1x4

Layout
  SM3257 1138_31 Xor 00f6_128_SA
Mix
  Input
    Order  0/1/2/3
  Block Pair
    Block  0x800000
    Page   0x4000
  Join by Page
    Parts  4
    Page   0x8000
Assembler
  Block Number
    Block Size      0x4000000
    Banks           0..3 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  Serg forum 10810

Monolith_SD_6 98 d7 94 32 1x2

Layout
  SD_20 1074_1070 Xor 6771_128
Mix
  Input
    Order  0/1
  Join by Dump
    Parts  2
  Cross Bank
    Block  0x100000
    Bank   0x800
  Block Rotate
    Block  0x100000
    Page   0x2000
Assembler
  Block Number
    Block Size      0x100000
    Bank Space      0x800
    Image Cut       0x3600000
  Actions
    Scan
    Find Bank Size  
Comments
    By Arvika
    Perfect recovery

Monolith_SD_7 ec d5 14 b6 1x1

Layout
  SK6281 Back 16
Mix
  Input
    Order  0
  Block Pair
    Block  0x80000
    Page   0x1000
Assembler
  Block Number
    Block Size   0x100000
    Bank Space   0x400
  Actions
    Scan
    Find Bank Size
Comments
    By Arvika
    Run auto conflict, very good recovery

Monolith_SD_7 ec d7 94 7a 1x1

Layout
  EN2683 1094 Xor 00f6_128
Mix
  Input
    Order  0
  Block Pair
    Block  0x100000
    Page   0x2000
Assembler
  Block Number
    Block Size      0x200000
    Banks           0..7 / 0x000 / 0x0ff
    
    // Sector Updates
    Update Size     0x4000
    Update Enable   true
  Actions
    Scan
Comments
  by Arvika
  FAT corrupted, must rebuild manually

Monolith_SD_7 ec d7 94 7a 1x2

Layout
  EN2683 1094 Xor 00f6_128
Mix
  Input
    Order  0/1
  Block Pair
    Block  0x100000
    Page   0x2000
  Join by Page
    Parts  2
    Page   0x4000
Assembler
  Block Number
    Block Size      0x400000
    Banks           0..7 / 0x000 / 0x0ff
    
    // Sector Updates
    Update Size     0x4000
    Update Enable   true
  Actions
    Scan
Comments
  Serg for forum 5695
  Used config with Bus = 8

Monolith_SD_7 ec d7 98 c6 1x1

Layout
  Monolith Micro SD_3 2138
  
Device is xored
Xor applied before ECC
Xor depend from block number
Block number is located at translator table

Cant find translator table
Cant remove XOR
Thats why ecc map is red

Monolith_SD_9 98 de 94 82 1x4

Layout
  SD_20 v2 1109_1103 Xor 0561_256
Mix
  Input
    Order  0/1/2/3
  Block Pair
    Block  0x200000
    Page   0x2000
  Divide
    Field  Block Number
    Value  0x10
  Block Rotate
    Block  0x400000
    Page   0x2000
  Join by Dump
    Parts  4
Assembler
  Block Number
    Block Size      0x400000
    Bank Space      0x800
    Image Cut       0x5800000/0/(0/0x8000/(0/0x8000/0x8000/0)*31/0x208000/0)*12
    Banks           0..3 / 0x000 / 0x77f
  Actions
    Scan
    Find Bank Size
Comments
  Serg for case 938

上一篇：SD Part 1-2
下一篇：SD Part 3

站内搜索

联系我们