SD Part 3Flash Extractor-芯片级数据恢复取证方案025-83608636

SD Part 3

Monolith SD 29 98 3e 96 93 1x4

Layout
  Unknown 1118_1102 Xor 0561_256 Cut
Mix
  Input
    Order  0/1/2/3
  Block Cut
    Block  0x8000/0x4000/(0x4000/0x4000)*125/0x4000/0x8000
  Block Pair
    Block  0x200000
    Page   0x4000
  Join by Page
    Parts  4
    Page   0x8000
Assembler
  Block Number
    Block Size   0x1000000
    Bank Space   0x800
    Banks        00 / 0x000 / 0x7c1
                 01 / 0x000 / 0x7c1
                 02 / 0x000 / 0x7c1
                 03 / 0x000 / 0x7b9
  Actions
    Scan
Comments
  JeremyB - exFAT couldn't make filesystem
  Raw Recovery - Good results

Monolith SD 30 ad 3a 14 03 1x1

Layout
  PS 1126_2 Xor 5061_256
Mix
  Input
    Order  0
  Block Pair
    Block  0x610000
    Page   0x4000
  Cut Bits
    Field  Sector Number
    Mask   0x80
Assembler
  Sector Number Slow
    Sector Size  0x8000
Comments
  Serg for forum 11273

Monolith SD SM2702 ad de 94 d2 2x1

Layout
  SM2702 1075_31 Xor b36e_128
Mix
  Input
    Order  1/0
  Join by Byte
    Parts  2
    Data   true
  Block Pair
    Block  0x400000
    Page   0x4000
Assembler
  Block Number
    Block Size      0x800000
    Banks           00..07 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  by Arvika

Monolith SD SM 2c 48 04 4a 1x2

Layout
  SM3254 1066 v3 Invert
Mix
  Input
    Order  0/1
  Block Pair
    Block  0x100000
    Page   0x1000
  Join by Page
    Parts  2
    Page   0x2000
Assembler
  Block Number
    Block Size      0x400000
    Image Cut       0x400000
    Banks           00..03 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  By Arvika

Monolith SD_19 2c 88 04 4b 1x1

Layout
  SM3257 1066_27
Mix
  Input
    Order  0
  Block Pair
    Block  0x200000
    Page   0x2000
Assembler
  Block Number
    Block Size      0x400000
    Banks           00..07 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  by Arvika
  first block ereased
  RAW recovery give good result.

Monolith SD_20 ad de 94 d2 2x2

Layout
  SM2702 1075_31 Xor b36e_128
Mix
  Input
    Order  2/0/3/1
  Join by Byte
    Parts  2
    Data   true
  Block Pair
    Block  0x400000
    Page   0x4000
  Join by Page
    Parts  2
    Page   0x8000
Assembler
  Block Number
    Block Size      0x1000000
  Actions
    Scan
    Find Bank Size
Comments
  by Arvika
  RAW recovery if dir structure is damaged

Monolith SD_21 ad de 94 da 2x2

Layout
  SM3257 1100_31 Xor b36e_128
Mix
  Input
    Order  2/0/3/1
  Join by Byte
    Parts  2
    Data   true
  Block Pair
    Block  0x400000
    Page   0x4000
  Join by Page
    Parts  2
    Page   0x8000
  Block Renum
    Block  0x1000000
    Page   0x8000
Assembler
  Block Number
    Block Size      0x1000000
    Banks           00..07 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  by Arvika
  Block renum maybe no need

Monolith SD_22 45 de 94 82 1x4

Layout
  5523A1 1070 Xor 267f_256 Mod
Mix
  Input
    Order  0/1/2/3
  Block Pair
    Block  0x200000
    Page   0x2000
  Join by Dump
    Parts  4
Assembler
  Block Number
    Block Size   0x400000
    Banks        0..63 / 0x000 / 0x07f
  Actions
    Scan
Comments
  Serg for forum 10199

Monolith SD_23 ec de a4 7a 2x4

Layout
  SM3257 1100_31 Xor f600_128 SA v2
Mix
  Input
    Order  0/4/1/5/2/3/6/7
  Join by Byte
    Parts  2
    Data   true
  Block Pair
    Block  0x200000
    Page   0x4000
  Block Pair
    Block  0x400000
    Page   0x8000
  Join by Page
    Parts  2
    Page   0x10000
  Join by Dump
    Parts  2
Assembler
  Block Number
    Block Size      0x1000000
    Banks           0..15 / 0x000 / 0x0ff
  Actions
    Scan
Comments
  Serg for forum 10277

Monolith SD_24 45 3a 98 b3 1x1

Layout
  PS 1146 Xor 5061_256
Mix
  Input
    Order  0
  Block Pair
    Block  0xc00000
    Page   0x4000
  Cut Bits
    Field  Sector Number
    Mask   0x80
Assembler
  Sector Number Slow
    Sector Size  0x8000
Comments
  by Arvika
  save image, open IE, FAT32 start at 0x400000

Monolith SD_24 45 3c 98 b3 1x1

Layout
  PS 1146 Xor 5061_256
Mix
  Input
    Order  0
  Block Pair
    Block  0xc00000
    Page   0x4000
  Cut Bits
    Field  Sector Number
    Mask   0x80
Assembler
  Sector Number Slow
    Sector Size  0x8000
Comments
  Serg for forum 10622

Monolith SD_25 98 3c 95 93 1x4

Layout
  Unknown 1118_1102 Xor 0561_256 Cut
Mix
  Input
    Order  0/1/2/3
  Block Cut
    Block  0x8000/0x4000/(0x4000/0x4000)*125/0x4000/0x8000
  Block Pair
    Block  0x200000
    Page   0x4000
  Join by Page
    Parts  4
    Page   0x8000
Assembler
  Block Number
    Block Size   0x1000000
    Bank Space   0x800
    
    Banks        00 / 0x000 / 0x6b1
                 01 / 0x000 / 0x7ba
  Actions
    Scan
Comments
  Serg for forum 10996
  Bank Sizes can be different
  Model verified only on LBA pattern

Monolith SD_26 98 3a 98 a3 1x4

Layout
  SD_20 v2 1148_1142
Mix
  Input
    Order  0/2/1/3
  Xor 5061
    Block     0x600000
    Page      0x4000
    Module    256
    BP Trash  false
  Join by Page
    Parts  4
    Page   0x4000
  Cross Bank
    Block  0x1800000
    Bank   0x5a5
Assembler
  Block Number
    Block Size      0x1800000
    Bank Space      0x5a5
    
    Banks           00 / 0x000 / 0x5a5
                    01 / 0x000 / 0x5a5
  Actions
    Scan
Comments
  Serg for forum 11186

Monolith SD_27 45 3a a4 93 2x8

Layout
  SM2702 1108_31 Xor 2850_256 v4 SA
Mix
  Input
    Order  7/15/2/10/1/9/4/12/5/13/0/8/3/11/6/14
  Join by Byte
    Parts  2
    Data   true
  Block Pair
    Block  0x800000
    Page   0x8000
  Join by Page
    Parts  2
    Page   0x10000
  Join by Dump
    Parts  4
  Cut Bits
    Field  Bank Number
    Mask   0xc0
Assembler
  Block Number
    Block Size      0x2000000
    Banks           0..31 / 0x000 / 0x0fd
  Actions
    Scan
Comments
  Serg for forum 11189
  Many lost blocks
  Can not verify model
  There was ExFAT and boot sector is missing
  Got 90% good jpegs with Raw Recovery

Monolith SD_29 89 c4 08 32 1x4

Unrecoverable

I think this card use LDPC ECC

When 3 bytes changed in sector,
only some lines changes in ECC, 
but rest 80% keep same

Sector 4096_472 = 4568

Xor 00 b1 bd

Monolith SD_30 98 3a 94 93 2x2

Layout
  PS8210 1106_1102 Xor 0561_256 v2
Mix
  Input
    Order  0/2/1/3
  Join by Page
    Parts  2
    Page   0x200
  Block Pair
    Block  0x800000
    Page   0x8000
  Join by Page
    Parts  2
    Page   0x10000
Assembler
  Block Number
    Block Size   0x2000000
    Bank Space   0x4000
    Banks        00 / 0x000 / 0x7ff
  Actions
    Scan
Comments
  by Arvika
  dump order can be other
  RAW recovery

Monolith SD_30 98 3c 98 b3 1x2

Unrecoverable

I think this card use LDPC ECC

When 3 bytes changed in sector,
only some lines changes in ECC, 
but rest 80% keep same

Sector 4096_472 = 4568

Xor 00 b1 bd

Monolith SD_31 98 3e 99 b3 1x4

Unrecoverable

I think this card use LDPC ECC

When 3 bytes changed in sector,
only some lines changes in ECC, 
but rest 80% keep same

Sector 4096_472 = 4568

Monolith SD_32 98 3e 98 b3 1x4

Unrecoverable

I think this card use LDPC ECC

Sector 4096_472 = 4568

Monolith SD_33 98 3c 98 b3 1x2

Can not recover

LDPC

77 pattern have repeats and zeros in ECC

Sector: 2280

8_2048_8_216

Monolith SD_34 98 3a a4 93 2x2

Layout
  PS8210 1106_1102 Xor 0561_256 v2
Mix
  Input
    Order  0/2/1/3
  Join by Page
    Parts  2
    Page   0x200
  Block Pair
    Block  0x800000
    Page   0x8000
  Join by Page
    Parts  2
    Page   0x10000
Assembler
  Block Number
    Block Size   0x2000000
    Bank Space   0x4000
    Banks        00 / 0x000 / 0x7ff
  Actions
    Scan
Comments
  Serg for forum 12036
  
  Raw Recovery:
  3961 good, 174 broken jpegs

Monolith SD_35 98 3e 96 93 1x4

Layout
  Unknown 1106_1100 Xor 0561_256 Cut
Mix
  Input
    Order  0/1/2/3
  Block Cut
    Block  0x8000/0x4000/(0x4000/0x4000)*125/0x4000/0x8000
  Block Pair
    Block  0x200000
    Page   0x4000
  Join by Page
    Parts  4
    Page   0x8000
Assembler
  Block Number
    Block Size   0x1000000
    Bank Space   0x800
    Image Cut    0x4020000
    Banks        00..03 / 0x000 / 0x7ff
  Actions
    Scan
Comments
  by Arvika
  exFAT couldn't make filesystem
  Raw Recovery give very good results

Monolith SD_36 45 48 97 93 1x1

Layout
  20-82-00270-1 14_2048_146 Xor C634 16_2
Mix
  Input
    Order  0
  Block Pair
    Block  0x400000
    Page   0x4000
  Block Pair
    Block  0x800000
    Page   0x8000
  Block Pair
    Block  0x400000000
    Page   0x10000
Assembler
  Block Number
    Block Size   0x40000
    Bank Space   0x80000
    Banks        00 / 0x000 / 0x80000
  Actions
    Scan
Comments
  Serg for forum 12070

Monolith SD_37 98 3a a8 92 1x1

Layout
  PS2251 1152_1146 v3
Mix
  Input
    Order  0/1/2/3
  Cut Bad Bytes
  Xor 5061
    Block     0x204000
    Page      0x2000
    Module    256
    BP Trash  true
  Block Pair
    Block  0x204000
    Page   0x2000
  Join by Page
    Parts  4
    Page   0x4000
  Cross Bank
    Block  0x1020000
    Bank   0x826
  Block Cut
    Block  0x1000000/0x20000
Assembler
  Block Number
    Block Size      0x1000000
    Bank Space      0x826
    
    Banks           00 / 0x000 / 0x737
                    01 / 0x000 / 0x66b
  Actions
    Scan
Comments
  Serg for forum 12102
  
  Model not finished
  
  Looks like even blocks unxored well
  but odd blocks is not unxored
  
  You can save image, use any scan software
  50% of files will be good
  
  Need 77 pattern

Monolith SD_38 98 3c 98 b3 1x4

Can not recover

May be LDPC

77 pattern have repeats and zeros in ECC

Sector: 2048+

Xor may be: 74cc

Monolith SD_39 98 3e 98 b3 1x1

Unrecoverable

I think this card use LDPC ECC

When 3 bytes changed in sector,
only some lines changes in ECC, 
but rest 80% keep same

Sector 4096_472 = 4568

Monolith SD_40 98 de 94 82 1x2

Layout
  SD_20 v2 1109_1103 Xor 0561_256
Mix
  Input
    Order  0/1
  Block Pair
    Block  0x200000
    Page   0x2000
  Join by Dump
    Parts  2
  Block Rotate
    Block  0x400000
    Page   0x2000
Assembler
  Block Number
    Block Size      0x400000
    Bank Space      0x800
  Actions
    Scan
    Find Bank Size
Comments
  by Arvika
  RAW recovery

Monolith SD_41 98 3c 98 b3 1x1

Unrecoverable

I think this card use LDPC ECC

When 3 bytes changed in sector,
only some lines changes in ECC, 
but rest 80% keep same

Sector 4096_472 = 4568

Monolith SD_42 ec 1c 98 3f 1x4

Layout
  Unknown 1136_31 Xor 2850_768 v2 Test
Mix
  Input
    Order  0/1/2/3
  Join by Dump
    Parts  4
  Block Pair
    Block  0xc00000
    Page   0x4000
  Block Pair
    Block  0x4000
    Page   0x800
Assembler
  Sector Number Slow
    Sector Size     0x1000
Comments
  Serg for forum 12393
  
  ECC Fix
  ECC Check
  Scan
  
  Delete last mix step
  
  Open or Save Image

Monolith SD_43 ec d7 94 76 1x1

Sector 1084_30 

Xor ff_00 grid on data
Xor before ECC 
Xor depends from BN

There is no BN in SA 

So, there must be translator table 
FE can not use TT to unxor other blocks

Unrecoverable

Monolith SD_44 98 3c 98 b3 1x4

Sector 4096_472 = 4568 

LDPC 

Can not recover

Monolith SD_45 ec 3a 94 43 1x1

Layout
  PS 1116 Xor 5061_256
Mix
  Input
    Order  0
  Block Pair
    Block  0x4b0000
    Page   0x4000
  Cut Bits
    Field  Sector Number
    Mask   0x80
Assembler
  Sector Number Slow
    Sector Size     0x8000
Comments
  Serg for forum 12696
  
  raw test: 636 good, 133 broken

Monolith SD_46 98 48 98 03 1x3

Sector 4568, LDPC

Can not recover

上一篇：SD Part 2
下一篇： USB Part 1

站内搜索

联系我们